Overview

overview

10

Static

static

10

2024-08-12...ch.exe

windows7-x64

10

2024-08-12...ch.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    127s
  • max time network
    127s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12-08-2024 07:07

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe

  • Size

    2.2MB

  • MD5

    61a8fc763aa8bfdb1e43001566bcfce7

  • SHA1

    b65880c2c590b3d2f736bf2818be923214a6efe5

  • SHA256

    8d797c2e404f3162c836020500b99c524deedabfc4770ee54fd9e0ea8bfd2ef4

  • SHA512

    5c39fb96e97dd7291b55b3d16ca0b0521e391369aa639801054e1011b11b3680ec2374dac8b2447677a23bf480c4b2014bb90442f0e8afe1b298c08650d14823

  • SSDEEP

    24576:lm8bqgR8VT8P5ZmUbFJnDoaY3azzKSP/OFvIxJH92ZK86EqDh8YCJjiraf4oAV/j:v73h3P/4K81TjasiXCUVnjU1HO1

Score
10/10
hivecredential_accessdiscoverypersistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\PerfLogs\HOW_TO_DECRYPT.txt

Family

hive

Ransom Note
Your network has been breached and all data is encrypted. To decrypt all the data you will need to purchase our decryption software. Please contact our sales department at: http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/ Login: EQA9oydTxwXS Password: vNtgAgb3kMFmCooANNQr Follow the guidelines below to avoid losing your data: - Do not shutdown or reboot your computers, unmount external storages. - Do not try to decrypt data using third party software. It may cause irreversible damage. - Do not fool yourself. Encryption has perfect secrecy and it's impossible to decrypt without knowing the key. - Do not modify, rename or delete *.key.hive files. Your data will be undecryptable. - Do not modify or rename encrypted files. You will lose them. - Do not report to authorities. The negotiation process will be terminated immediately and the key will be erased. - Do not reject to purchase. Your sensitive data will be publicly disclosed at http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/
URLs

http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/

http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/

Signatures

  • Hive

    A ransomware written in Golang first seen in June 2021.

    ransomwarehive
  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Drops file in Drivers directory 20 IoCs
  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Drops startup file 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 64 IoCs
  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Delays execution with timeout.exe 64 IoCs
    evasion
  • Modifies registry class 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-08-12_61a8fc763aa8bfdb1e43001566bcfce7_snatch.exe"
    1⤵
    • Drops file in Drivers directory
    • Drops startup file
    • Drops desktop.ini file(s)
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1508
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c hive.bat >NUL 2>NUL
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2960
      • C:\Windows\SysWOW64\timeout.exe
        timeout 1
        3⤵
        • Delays execution with timeout.exe
        PID:4248
      • C:\Windows\SysWOW64\timeout.exe
        timeout 1
        3⤵
          PID:4428
        • C:\Windows\SysWOW64\timeout.exe
          timeout 1
          3⤵
          • Delays execution with timeout.exe
          PID:3776
        • C:\Windows\SysWOW64\timeout.exe
          timeout 1
          3⤵
          • Delays execution with timeout.exe
          PID:4116
        • C:\Windows\SysWOW64\timeout.exe
          timeout 1
          3⤵
          • System Location Discovery: System Language Discovery
          PID:532
        • C:\Windows\SysWOW64\timeout.exe
          timeout 1
          3⤵
          • System Location Discovery: System Language Discovery
          PID:1608
        • C:\Windows\SysWOW64\timeout.exe
          timeout 1
          3⤵
          • System Location Discovery: System Language Discovery
          • Delays execution with timeout.exe
          PID:4788
        • C:\Windows\SysWOW64\timeout.exe
          timeout 1
          3⤵
          • System Location Discovery: System Language Discovery
          PID:4088
        • C:\Windows\SysWOW64\timeout.exe
          timeout 1
          3⤵
          • Delays execution with timeout.exe
          PID:3240
        • C:\Windows\SysWOW64\timeout.exe
          timeout 1
          3⤵
          • System Location Discovery: System Language Discovery
          • Delays execution with timeout.exe
          PID:1888
        • C:\Windows\SysWOW64\timeout.exe
          timeout 1
          3⤵
          • System Location Discovery: System Language Discovery
          • Delays execution with timeout.exe
          PID:4736
        • C:\Windows\SysWOW64\timeout.exe
          timeout 1
          3⤵
            PID:4640
          • C:\Windows\SysWOW64\timeout.exe
            timeout 1
            3⤵
            • System Location Discovery: System Language Discovery
            PID:1356
          • C:\Windows\SysWOW64\timeout.exe
            timeout 1
            3⤵
              PID:4600
            • C:\Windows\SysWOW64\timeout.exe
              timeout 1
              3⤵
              • System Location Discovery: System Language Discovery
              PID:536
            • C:\Windows\SysWOW64\timeout.exe
              timeout 1
              3⤵
              • Delays execution with timeout.exe
              PID:4176
            • C:\Windows\SysWOW64\timeout.exe
              timeout 1
              3⤵
              • Delays execution with timeout.exe
              PID:4636
            • C:\Windows\SysWOW64\timeout.exe
              timeout 1
              3⤵
              • System Location Discovery: System Language Discovery
              • Delays execution with timeout.exe
              PID:4436
            • C:\Windows\SysWOW64\timeout.exe
              timeout 1
              3⤵
              • Delays execution with timeout.exe
              PID:1604
            • C:\Windows\SysWOW64\timeout.exe
              timeout 1
              3⤵
                PID:3916
              • C:\Windows\SysWOW64\timeout.exe
                timeout 1
                3⤵
                • System Location Discovery: System Language Discovery
                PID:2128
              • C:\Windows\SysWOW64\timeout.exe
                timeout 1
                3⤵
                • System Location Discovery: System Language Discovery
                PID:3684
              • C:\Windows\SysWOW64\timeout.exe
                timeout 1
                3⤵
                • System Location Discovery: System Language Discovery
                PID:4992
              • C:\Windows\SysWOW64\timeout.exe
                timeout 1
                3⤵
                • System Location Discovery: System Language Discovery
                • Delays execution with timeout.exe
                PID:4560
              • C:\Windows\SysWOW64\timeout.exe
                timeout 1
                3⤵
                • Delays execution with timeout.exe
                PID:4356
              • C:\Windows\SysWOW64\timeout.exe
                timeout 1
                3⤵
                • System Location Discovery: System Language Discovery
                • Delays execution with timeout.exe
                PID:3152
              • C:\Windows\SysWOW64\timeout.exe
                timeout 1
                3⤵
                • System Location Discovery: System Language Discovery
                • Delays execution with timeout.exe
                PID:2948
              • C:\Windows\SysWOW64\timeout.exe
                timeout 1
                3⤵
                  PID:2304
                • C:\Windows\SysWOW64\timeout.exe
                  timeout 1
                  3⤵
                  • System Location Discovery: System Language Discovery
                  • Delays execution with timeout.exe
                  PID:5064
                • C:\Windows\SysWOW64\timeout.exe
                  timeout 1
                  3⤵
                  • System Location Discovery: System Language Discovery
                  PID:4624
                • C:\Windows\SysWOW64\timeout.exe
                  timeout 1
                  3⤵
                  • System Location Discovery: System Language Discovery
                  PID:2608
                • C:\Windows\SysWOW64\timeout.exe
                  timeout 1
                  3⤵
                  • System Location Discovery: System Language Discovery
                  PID:4788
                • C:\Windows\SysWOW64\timeout.exe
                  timeout 1
                  3⤵
                  • Delays execution with timeout.exe
                  PID:4144
                • C:\Windows\SysWOW64\timeout.exe
                  timeout 1
                  3⤵
                    PID:3688
                  • C:\Windows\SysWOW64\timeout.exe
                    timeout 1
                    3⤵
                      PID:1888
                    • C:\Windows\SysWOW64\timeout.exe
                      timeout 1
                      3⤵
                      • System Location Discovery: System Language Discovery
                      • Delays execution with timeout.exe
                      PID:3252
                    • C:\Windows\SysWOW64\timeout.exe
                      timeout 1
                      3⤵
                        PID:2484
                      • C:\Windows\SysWOW64\timeout.exe
                        timeout 1
                        3⤵
                        • System Location Discovery: System Language Discovery
                        PID:2968
                      • C:\Windows\SysWOW64\timeout.exe
                        timeout 1
                        3⤵
                        • System Location Discovery: System Language Discovery
                        PID:1728
                      • C:\Windows\SysWOW64\timeout.exe
                        timeout 1
                        3⤵
                        • System Location Discovery: System Language Discovery
                        PID:4632
                      • C:\Windows\SysWOW64\timeout.exe
                        timeout 1
                        3⤵
                        • Delays execution with timeout.exe
                        PID:3696
                      • C:\Windows\SysWOW64\timeout.exe
                        timeout 1
                        3⤵
                          PID:3644
                        • C:\Windows\SysWOW64\timeout.exe
                          timeout 1
                          3⤵
                            PID:3948
                          • C:\Windows\SysWOW64\timeout.exe
                            timeout 1
                            3⤵
                            • System Location Discovery: System Language Discovery
                            PID:5000
                          • C:\Windows\SysWOW64\timeout.exe
                            timeout 1
                            3⤵
                              PID:3760
                            • C:\Windows\SysWOW64\timeout.exe
                              timeout 1
                              3⤵
                              • System Location Discovery: System Language Discovery
                              • Delays execution with timeout.exe
                              PID:4852
                            • C:\Windows\SysWOW64\timeout.exe
                              timeout 1
                              3⤵
                              • System Location Discovery: System Language Discovery
                              • Delays execution with timeout.exe
                              PID:3772
                            • C:\Windows\SysWOW64\timeout.exe
                              timeout 1
                              3⤵
                              • System Location Discovery: System Language Discovery
                              PID:3996
                            • C:\Windows\SysWOW64\timeout.exe
                              timeout 1
                              3⤵
                              • System Location Discovery: System Language Discovery
                              PID:1596
                            • C:\Windows\SysWOW64\timeout.exe
                              timeout 1
                              3⤵
                              • System Location Discovery: System Language Discovery
                              • Delays execution with timeout.exe
                              PID:4296
                            • C:\Windows\SysWOW64\timeout.exe
                              timeout 1
                              3⤵
                              • Delays execution with timeout.exe
                              PID:2544
                            • C:\Windows\SysWOW64\timeout.exe
                              timeout 1
                              3⤵
                              • System Location Discovery: System Language Discovery
                              • Delays execution with timeout.exe
                              PID:4568
                            • C:\Windows\SysWOW64\timeout.exe
                              timeout 1
                              3⤵
                              • System Location Discovery: System Language Discovery
                              PID:3800
                            • C:\Windows\SysWOW64\timeout.exe
                              timeout 1
                              3⤵
                              • System Location Discovery: System Language Discovery
                              • Delays execution with timeout.exe
                              PID:1364
                            • C:\Windows\SysWOW64\timeout.exe
                              timeout 1
                              3⤵
                              • Delays execution with timeout.exe
                              PID:2188
                            • C:\Windows\SysWOW64\timeout.exe
                              timeout 1
                              3⤵
                              • System Location Discovery: System Language Discovery
                              • Delays execution with timeout.exe
                              PID:2684
                            • C:\Windows\SysWOW64\timeout.exe
                              timeout 1
                              3⤵
                              • Delays execution with timeout.exe
                              PID:1112
                            • C:\Windows\SysWOW64\timeout.exe
                              timeout 1
                              3⤵
                              • Delays execution with timeout.exe
                              PID:4852
                            • C:\Windows\SysWOW64\timeout.exe
                              timeout 1
                              3⤵
                              • Delays execution with timeout.exe
                              PID:3916
                            • C:\Windows\SysWOW64\timeout.exe
                              timeout 1
                              3⤵
                              • Delays execution with timeout.exe
                              PID:2672
                            • C:\Windows\SysWOW64\timeout.exe
                              timeout 1
                              3⤵
                                PID:3308
                              • C:\Windows\SysWOW64\timeout.exe
                                timeout 1
                                3⤵
                                • System Location Discovery: System Language Discovery
                                PID:3824
                              • C:\Windows\SysWOW64\timeout.exe
                                timeout 1
                                3⤵
                                • Delays execution with timeout.exe
                                PID:3996
                              • C:\Windows\SysWOW64\timeout.exe
                                timeout 1
                                3⤵
                                • System Location Discovery: System Language Discovery
                                • Delays execution with timeout.exe
                                PID:2608
                              • C:\Windows\SysWOW64\timeout.exe
                                timeout 1
                                3⤵
                                • System Location Discovery: System Language Discovery
                                PID:752
                              • C:\Windows\SysWOW64\timeout.exe
                                timeout 1
                                3⤵
                                • System Location Discovery: System Language Discovery
                                • Delays execution with timeout.exe
                                PID:1520
                              • C:\Windows\SysWOW64\timeout.exe
                                timeout 1
                                3⤵
                                • System Location Discovery: System Language Discovery
                                PID:2080
                              • C:\Windows\SysWOW64\timeout.exe
                                timeout 1
                                3⤵
                                • Delays execution with timeout.exe
                                PID:4760
                              • C:\Windows\SysWOW64\timeout.exe
                                timeout 1
                                3⤵
                                • System Location Discovery: System Language Discovery
                                • Delays execution with timeout.exe
                                PID:3956
                              • C:\Windows\SysWOW64\timeout.exe
                                timeout 1
                                3⤵
                                • Delays execution with timeout.exe
                                PID:2420
                              • C:\Windows\SysWOW64\timeout.exe
                                timeout 1
                                3⤵
                                • Delays execution with timeout.exe
                                PID:4336
                              • C:\Windows\SysWOW64\timeout.exe
                                timeout 1
                                3⤵
                                  PID:2076
                                • C:\Windows\SysWOW64\timeout.exe
                                  timeout 1
                                  3⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:2504
                                • C:\Windows\SysWOW64\timeout.exe
                                  timeout 1
                                  3⤵
                                  • Delays execution with timeout.exe
                                  PID:3468
                                • C:\Windows\SysWOW64\timeout.exe
                                  timeout 1
                                  3⤵
                                    PID:2188
                                  • C:\Windows\SysWOW64\timeout.exe
                                    timeout 1
                                    3⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:2716
                                  • C:\Windows\SysWOW64\timeout.exe
                                    timeout 1
                                    3⤵
                                      PID:2588
                                    • C:\Windows\SysWOW64\timeout.exe
                                      timeout 1
                                      3⤵
                                      • Delays execution with timeout.exe
                                      PID:2296
                                    • C:\Windows\SysWOW64\timeout.exe
                                      timeout 1
                                      3⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:2304
                                    • C:\Windows\SysWOW64\timeout.exe
                                      timeout 1
                                      3⤵
                                      • System Location Discovery: System Language Discovery
                                      • Delays execution with timeout.exe
                                      PID:2072
                                    • C:\Windows\SysWOW64\timeout.exe
                                      timeout 1
                                      3⤵
                                      • System Location Discovery: System Language Discovery
                                      • Delays execution with timeout.exe
                                      PID:4944
                                    • C:\Windows\SysWOW64\timeout.exe
                                      timeout 1
                                      3⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:1344
                                    • C:\Windows\SysWOW64\timeout.exe
                                      timeout 1
                                      3⤵
                                      • System Location Discovery: System Language Discovery
                                      • Delays execution with timeout.exe
                                      PID:3832
                                    • C:\Windows\SysWOW64\timeout.exe
                                      timeout 1
                                      3⤵
                                        PID:2876
                                      • C:\Windows\SysWOW64\timeout.exe
                                        timeout 1
                                        3⤵
                                        • Delays execution with timeout.exe
                                        PID:1580
                                      • C:\Windows\SysWOW64\timeout.exe
                                        timeout 1
                                        3⤵
                                        • System Location Discovery: System Language Discovery
                                        • Delays execution with timeout.exe
                                        PID:744
                                      • C:\Windows\SysWOW64\timeout.exe
                                        timeout 1
                                        3⤵
                                        • System Location Discovery: System Language Discovery
                                        • Delays execution with timeout.exe
                                        PID:1200
                                      • C:\Windows\SysWOW64\timeout.exe
                                        timeout 1
                                        3⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:5080
                                      • C:\Windows\SysWOW64\timeout.exe
                                        timeout 1
                                        3⤵
                                        • System Location Discovery: System Language Discovery
                                        • Delays execution with timeout.exe
                                        PID:5040
                                      • C:\Windows\SysWOW64\timeout.exe
                                        timeout 1
                                        3⤵
                                        • System Location Discovery: System Language Discovery
                                        • Delays execution with timeout.exe
                                        PID:3944
                                      • C:\Windows\SysWOW64\timeout.exe
                                        timeout 1
                                        3⤵
                                          PID:1996
                                        • C:\Windows\SysWOW64\timeout.exe
                                          timeout 1
                                          3⤵
                                            PID:692
                                          • C:\Windows\SysWOW64\timeout.exe
                                            timeout 1
                                            3⤵
                                            • Delays execution with timeout.exe
                                            PID:4648
                                          • C:\Windows\SysWOW64\timeout.exe
                                            timeout 1
                                            3⤵
                                            • System Location Discovery: System Language Discovery
                                            PID:180
                                          • C:\Windows\SysWOW64\timeout.exe
                                            timeout 1
                                            3⤵
                                            • Delays execution with timeout.exe
                                            PID:4336
                                          • C:\Windows\SysWOW64\timeout.exe
                                            timeout 1
                                            3⤵
                                            • Delays execution with timeout.exe
                                            PID:1388
                                          • C:\Windows\SysWOW64\timeout.exe
                                            timeout 1
                                            3⤵
                                            • System Location Discovery: System Language Discovery
                                            PID:1368
                                          • C:\Windows\SysWOW64\timeout.exe
                                            timeout 1
                                            3⤵
                                            • Delays execution with timeout.exe
                                            PID:4152
                                          • C:\Windows\SysWOW64\timeout.exe
                                            timeout 1
                                            3⤵
                                              PID:612
                                            • C:\Windows\SysWOW64\timeout.exe
                                              timeout 1
                                              3⤵
                                              • System Location Discovery: System Language Discovery
                                              • Delays execution with timeout.exe
                                              PID:3012
                                            • C:\Windows\SysWOW64\timeout.exe
                                              timeout 1
                                              3⤵
                                              • System Location Discovery: System Language Discovery
                                              PID:1696
                                            • C:\Windows\SysWOW64\timeout.exe
                                              timeout 1
                                              3⤵
                                              • System Location Discovery: System Language Discovery
                                              PID:388
                                            • C:\Windows\SysWOW64\timeout.exe
                                              timeout 1
                                              3⤵
                                              • System Location Discovery: System Language Discovery
                                              PID:4308
                                            • C:\Windows\SysWOW64\timeout.exe
                                              timeout 1
                                              3⤵
                                              • System Location Discovery: System Language Discovery
                                              PID:2876
                                            • C:\Windows\SysWOW64\timeout.exe
                                              timeout 1
                                              3⤵
                                              • System Location Discovery: System Language Discovery
                                              PID:2896
                                            • C:\Windows\SysWOW64\timeout.exe
                                              timeout 1
                                              3⤵
                                                PID:3588
                                              • C:\Windows\SysWOW64\timeout.exe
                                                timeout 1
                                                3⤵
                                                  PID:1888
                                                • C:\Windows\SysWOW64\timeout.exe
                                                  timeout 1
                                                  3⤵
                                                  • System Location Discovery: System Language Discovery
                                                  PID:4588
                                                • C:\Windows\SysWOW64\timeout.exe
                                                  timeout 1
                                                  3⤵
                                                  • Delays execution with timeout.exe
                                                  PID:1348
                                                • C:\Windows\SysWOW64\timeout.exe
                                                  timeout 1
                                                  3⤵
                                                  • System Location Discovery: System Language Discovery
                                                  PID:4792
                                                • C:\Windows\SysWOW64\timeout.exe
                                                  timeout 1
                                                  3⤵
                                                    PID:2284
                                                  • C:\Windows\SysWOW64\timeout.exe
                                                    timeout 1
                                                    3⤵
                                                    • System Location Discovery: System Language Discovery
                                                    PID:4752
                                                  • C:\Windows\SysWOW64\timeout.exe
                                                    timeout 1
                                                    3⤵
                                                    • Delays execution with timeout.exe
                                                    PID:4136
                                                  • C:\Windows\SysWOW64\timeout.exe
                                                    timeout 1
                                                    3⤵
                                                      PID:4004
                                                    • C:\Windows\SysWOW64\timeout.exe
                                                      timeout 1
                                                      3⤵
                                                      • Delays execution with timeout.exe
                                                      PID:1340
                                                    • C:\Windows\SysWOW64\timeout.exe
                                                      timeout 1
                                                      3⤵
                                                        PID:2740
                                                      • C:\Windows\SysWOW64\timeout.exe
                                                        timeout 1
                                                        3⤵
                                                        • Delays execution with timeout.exe
                                                        PID:3672
                                                      • C:\Windows\SysWOW64\timeout.exe
                                                        timeout 1
                                                        3⤵
                                                        • Delays execution with timeout.exe
                                                        PID:3692
                                                      • C:\Windows\SysWOW64\timeout.exe
                                                        timeout 1
                                                        3⤵
                                                        • Delays execution with timeout.exe
                                                        PID:3988
                                                      • C:\Windows\SysWOW64\timeout.exe
                                                        timeout 1
                                                        3⤵
                                                          PID:2124
                                                        • C:\Windows\SysWOW64\timeout.exe
                                                          timeout 1
                                                          3⤵
                                                            PID:4312
                                                          • C:\Windows\SysWOW64\timeout.exe
                                                            timeout 1
                                                            3⤵
                                                            • Delays execution with timeout.exe
                                                            PID:3320
                                                          • C:\Windows\SysWOW64\timeout.exe
                                                            timeout 1
                                                            3⤵
                                                              PID:3080
                                                            • C:\Windows\SysWOW64\timeout.exe
                                                              timeout 1
                                                              3⤵
                                                                PID:3356
                                                              • C:\Windows\SysWOW64\timeout.exe
                                                                timeout 1
                                                                3⤵
                                                                • Delays execution with timeout.exe
                                                                PID:4792
                                                              • C:\Windows\SysWOW64\timeout.exe
                                                                timeout 1
                                                                3⤵
                                                                  PID:2180
                                                                • C:\Windows\SysWOW64\timeout.exe
                                                                  timeout 1
                                                                  3⤵
                                                                    PID:2536
                                                                  • C:\Windows\SysWOW64\timeout.exe
                                                                    timeout 1
                                                                    3⤵
                                                                      PID:3996
                                                                    • C:\Windows\SysWOW64\timeout.exe
                                                                      timeout 1
                                                                      3⤵
                                                                      • Delays execution with timeout.exe
                                                                      PID:4900
                                                                    • C:\Windows\SysWOW64\timeout.exe
                                                                      timeout 1
                                                                      3⤵
                                                                        PID:4752
                                                                      • C:\Windows\SysWOW64\timeout.exe
                                                                        timeout 1
                                                                        3⤵
                                                                          PID:2504
                                                                        • C:\Windows\SysWOW64\timeout.exe
                                                                          timeout 1
                                                                          3⤵
                                                                          • Delays execution with timeout.exe
                                                                          PID:1920
                                                                        • C:\Windows\SysWOW64\timeout.exe
                                                                          timeout 1
                                                                          3⤵
                                                                            PID:2208
                                                                          • C:\Windows\SysWOW64\timeout.exe
                                                                            timeout 1
                                                                            3⤵
                                                                              PID:744
                                                                            • C:\Windows\SysWOW64\timeout.exe
                                                                              timeout 1
                                                                              3⤵
                                                                              • Delays execution with timeout.exe
                                                                              PID:4544
                                                                            • C:\Windows\SysWOW64\timeout.exe
                                                                              timeout 1
                                                                              3⤵
                                                                                PID:2320
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c shadow.bat >NUL 2>NUL
                                                                              2⤵
                                                                                PID:2028
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4108,i,9445584274764997943,12714240264001792460,262144 --variations-seed-version --mojo-platform-channel-handle=4020 /prefetch:8
                                                                              1⤵
                                                                                PID:852
                                                                              • C:\Windows\explorer.exe
                                                                                explorer.exe
                                                                                1⤵
                                                                                • Boot or Logon Autostart Execution: Active Setup
                                                                                • Modifies registry class
                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                • Suspicious use of FindShellTrayWindow
                                                                                • Suspicious use of SendNotifyMessage
                                                                                PID:1780

                                                                              Network

                                                                              MITRE ATT&CK Enterprise v15

                                                                              Replay Monitor

                                                                              Loading Replay Monitor...

                                                                              Downloads

                                                                              • C:\$Recycle.Bin\S-1-5-21-2170637797-568393320-3232933035-1000\desktop.ini
                                                                                Filesize

                                                                                129B

                                                                                MD5

                                                                                c02ae28c356fe623f31695fb4aa0566e

                                                                                SHA1

                                                                                59a0900bd94f1663809a85808f817d07ad84edac

                                                                                SHA256

                                                                                338371ec1d547fee745430c854e6b3b3939c4e56087b8f9581bd692f0228df10

                                                                                SHA512

                                                                                ecd24de539a1f94a159dbd5231338b4e2bb63a1d9efc129f02930a37d081270d787a32cbbcf458f8288c78fc14938549a040ae61dad9f9ce8adcb664b3961cdb

                                                                                Download Submit

                                                                              • C:\PerfLogs\HOW_TO_DECRYPT.txt
                                                                                Filesize

                                                                                1KB

                                                                                MD5

                                                                                80207d0f8ea42bdfeaf9f5c586230aca

                                                                                SHA1

                                                                                747481fe2b0b6d81c3b19ba62d1e49eab6a5461f

                                                                                SHA256

                                                                                25edefb3b0678dfe0d927ff48ce67254359ba379df9468f634d02c026f0e7131

                                                                                SHA512

                                                                                73f68ce9e98d2346be1762bd54bb06ef83ae939dfbcf9b786d9b773fa454352613387d264b7a87a1c08950226553817bf01f5aa4107bc12de36a1689e2137304

                                                                                Download Submit

                                                                              • C:\ProgramData\Microsoft\Windows\Caches\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db.C5dk5EKAfuwXvvS6EdFcwlOGydL22IJz7TE2GVB2oDE.hive
                                                                                Filesize

                                                                                622KB

                                                                                MD5

                                                                                bc5614c4d544096493423b290e77aba7

                                                                                SHA1

                                                                                b34a4ffe594b5b0e0b22f01f46cdee06a035e057

                                                                                SHA256

                                                                                e13210c8e07eeb6696369bb69a712e882a663bbfa4511e5af392daa0a73e32b9

                                                                                SHA512

                                                                                65338198a0c094770aa2f8aa402cf5f8937a54bdfb3699b04f231f9e67356b48d6926d57367b7fbc9f84e5f7df151c3f32107fda9286a1825c32accf53fd38a6

                                                                                Download Submit

                                                                              • C:\Users\Admin\AppData\Local\Temp\hive.bat
                                                                                Filesize

                                                                                254B

                                                                                MD5

                                                                                084fc00cf61779cd2302fd4f25c6a01a

                                                                                SHA1

                                                                                c8f3f7e5d2c36aa21f154dce508803cdafc7feae

                                                                                SHA256

                                                                                6092fcdce0693ec89ba708c582a321e799dd24a5e7bc7cae65ee006f647fff70

                                                                                SHA512

                                                                                58128583a4825035f3add3262be08d688cc024a49006533b9d0bb810c543fb2bcd884b1bdbf8581beb347a4ff22593bc7e08284c8399d95b3e48df08e74f117c

                                                                                Download Submit

                                                                              • C:\Users\Admin\AppData\Local\Temp\shadow.bat
                                                                                Filesize

                                                                                57B

                                                                                MD5

                                                                                df5552357692e0cba5e69f8fbf06abb6

                                                                                SHA1

                                                                                4714f1e6bb75a80a8faf69434726d176b70d7bd8

                                                                                SHA256

                                                                                d158f9d53e7c37eadd3b5cc1b82d095f61484e47eda2c36d9d35f31c0b4d3ff8

                                                                                SHA512

                                                                                a837555a1175ab515e2b43da9e493ff0ccd4366ee59defe6770327818ca9afa6f3e39ecdf5262b69253aa9e2692283ee8cebc97d58edd42e676977c7f73d143d

                                                                                Download Submit