hive | 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1

Analysis

max time kernel
27s
max time network
21s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
17-09-2024 02:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Hive Ransomware.exe
Size

764KB
MD5

2f9fc82898d718f2abe99c4a6fa79e69
SHA1

9d336b8911c8ffd7cc809e31d5b53796bb0cc7bb
SHA256

88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1
SHA512

19f0879b1c54d305ab7a97a0d46ab79c103d4687fe37d5f9ef1934904eea48a1c66b1ac2de3dace6dc0d91623309287044c198cb0b3fc9f8453fbc9d1c0cae8b
SSDEEP

12288:CinNFNkY/yU97ppM4NSBG81Np2C9H4S3iDjlLtc4wCIITIQaOI6NrwacVYV+4MsT:CinN3n/y67jM4v4kCSPDjlLtbwt8IQLH

Score

10^/10

hive defense_evasion discovery execution impact ransomware upx

Malware Config

Extracted

Path

C:\MSOCache\HOW_TO_DECRYPT.txt

Family

hive

Ransom Note

Your network has been breached and all data is encrypted. To decrypt all the data you will need to purchase our decryption software. Please contact our sales department at: http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/ Login: EQA9oydTxwXS Password: vNtgAgb3kMFmCooANNQr Follow the guidelines below to avoid losing your data: - Do not shutdown or reboot your computers, unmount external storages. - Do not try to decrypt data using third party software. It may cause irreversible damage. - Do not fool yourself. Encryption has perfect secrecy and it's impossible to decrypt without knowing the key. - Do not modify, rename or delete *.key.hive files. Your data will be undecryptable. - Do not modify or rename encrypted files. You will lose them. - Do not report to authorities. The negotiation process will be terminated immediately and the key will be erased. - Do not reject to purchase. Your sensitive data will be publicly disclosed at http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/

URLs

http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/

http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/

Signatures

Detects Go variant of Hive Ransomware 3 IoCs

resource	yara_rule
behavioral1/memory/2640-1-0x0000000000BA0000-0x0000000000E03000-memory.dmp	hive_go
behavioral1/memory/2640-2-0x0000000000BA0000-0x0000000000E03000-memory.dmp	hive_go
behavioral1/memory/2640-3-0x0000000000BA0000-0x0000000000E03000-memory.dmp	hive_go

Hive
A ransomware written in Golang first seen in June 2021.
ransomware hive
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2640-0-0x0000000000BA0000-0x0000000000E03000-memory.dmp	upx
behavioral1/memory/2640-1-0x0000000000BA0000-0x0000000000E03000-memory.dmp	upx
behavioral1/memory/2640-2-0x0000000000BA0000-0x0000000000E03000-memory.dmp	upx
behavioral1/memory/2640-3-0x0000000000BA0000-0x0000000000E03000-memory.dmp	upx

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\$Recycle.Bin\S-1-5-21-457978338-2990298471-2379561640-1000\desktop.ini	Hive Ransomware.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-457978338-2990298471-2379561640-1000\desktop.ini	Hive Ransomware.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini	Hive Ransomware.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\HOW_TO_DECRYPT.txt	Hive Ransomware.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\hwrespsh.dat	Hive Ransomware.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipsfra.xml	Hive Ransomware.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\ja-JP\HOW_TO_DECRYPT.txt	Hive Ransomware.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\HOW_TO_DECRYPT.txt	Hive Ransomware.exe
File opened for modification	C:\Program Files\DVD Maker\en-US\OmdProject.dll.mui	Hive Ransomware.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\IpsMigrationPlugin.dll	Hive Ransomware.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\TabTip.exe	Hive Ransomware.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\en-US.pak	Hive Ransomware.exe
File created	C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\HOW_TO_DECRYPT.txt	Hive Ransomware.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Filters\VISFILT.DLL	Hive Ransomware.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPCEXT.DLL	Hive Ransomware.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Tiki.gif	Hive Ransomware.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\TipRes.dll.mui	Hive Ransomware.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_VideoInset.png	Hive Ransomware.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationRight_ButtonGraphic.png	Hive Ransomware.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationRight_ButtonGraphic.png	Hive Ransomware.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationRight_ButtonGraphic.png	Hive Ransomware.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXEV.DLL	Hive Ransomware.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\ShapeCollector.exe.mui	Hive Ransomware.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationRight_SelectionSubpicture.png	Hive Ransomware.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_plain_Thumbnail.bmp	Hive Ransomware.exe
File opened for modification	C:\Program Files\DVD Maker\it-IT\DVDMaker.exe.mui	Hive Ransomware.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\he.pak	Hive Ransomware.exe
File created	C:\Program Files\Common Files\HOW_TO_DECRYPT.txt	Hive Ransomware.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\split.avi	Hive Ransomware.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\it-IT\HOW_TO_DECRYPT.txt	Hive Ransomware.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\mshwLatin.dll	Hive Ransomware.exe
File opened for modification	C:\Program Files\ConvertToSubmit.midi	Hive Ransomware.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Scene_loop.wmv	Hive Ransomware.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\menu_style_default_Thumbnail.png	Hive Ransomware.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\InkObj.dll.mui	Hive Ransomware.exe
File opened for modification	C:\Program Files\Common Files\System\ado\msado28.tlb	Hive Ransomware.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\msdaprst.dll	Hive Ransomware.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\am.pak	Hive Ransomware.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\VC\msdia90.dll	Hive Ransomware.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyNotesBackground_PAL.wmv	Hive Ransomware.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\HOW_TO_DECRYPT.txt	Hive Ransomware.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationLeft_SelectionSubpicture.png	Hive Ransomware.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\sports_disc_mask.png	Hive Ransomware.exe
File created	C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\HOW_TO_DECRYPT.txt	Hive Ransomware.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\de-DE\msdaprsr.dll.mui	Hive Ransomware.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\msadds.dll	Hive Ransomware.exe
File created	C:\Program Files\Common Files\Microsoft Shared\HOW_TO_DECRYPT.txt	Hive Ransomware.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mr.txt	Hive Ransomware.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\en-US\msdasqlr.dll.mui	Hive Ransomware.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\HOW_TO_DECRYPT.txt	Hive Ransomware.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\15x15dot.png	Hive Ransomware.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-imageMask.png	Hive Ransomware.exe
File opened for modification	C:\Program Files\DVD Maker\WMM2CLIP.dll	Hive Ransomware.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hi.txt	Hive Ransomware.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tt.txt	Hive Ransomware.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\keypadbase.xml	Hive Ransomware.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_PreComp_MATTE_PAL.wmv	Hive Ransomware.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationUp_ButtonGraphic.png	Hive Ransomware.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\Filters.xml	Hive Ransomware.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\btn-back-static.png	Hive Ransomware.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\IPSEventLogMsg.dll.mui	Hive Ransomware.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationUp_SelectionSubpicture.png	Hive Ransomware.exe
File opened for modification	C:\Program Files\DVD Maker\bod_r.TTF	Hive Ransomware.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\play-background.png	Hive Ransomware.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\HOW_TO_DECRYPT.txt	Hive Ransomware.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\tipresx.dll.mui	Hive Ransomware.exe
File opened for modification	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\MSTTSCommon.dll	Hive Ransomware.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vssadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hive Ransomware.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Delays execution with timeout.exe 3 IoCs

evasion

pid	Process
2612	timeout.exe
2252	timeout.exe
1536	timeout.exe

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
2472	vssadmin.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2640	Hive Ransomware.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeBackupPrivilege	2348	vssvc.exe
Token: SeRestorePrivilege	2348	vssvc.exe
Token: SeAuditPrivilege	2348	vssvc.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2640 wrote to memory of 2528	2640	Hive Ransomware.exe	30
PID 2640 wrote to memory of 2528	2640	Hive Ransomware.exe	30
PID 2640 wrote to memory of 2528	2640	Hive Ransomware.exe	30
PID 2640 wrote to memory of 2528	2640	Hive Ransomware.exe	30
PID 2640 wrote to memory of 2176	2640	Hive Ransomware.exe	32
PID 2640 wrote to memory of 2176	2640	Hive Ransomware.exe	32
PID 2640 wrote to memory of 2176	2640	Hive Ransomware.exe	32
PID 2640 wrote to memory of 2176	2640	Hive Ransomware.exe	32
PID 2528 wrote to memory of 2612	2528	cmd.exe	34
PID 2528 wrote to memory of 2612	2528	cmd.exe	34
PID 2528 wrote to memory of 2612	2528	cmd.exe	34
PID 2528 wrote to memory of 2612	2528	cmd.exe	34
PID 2176 wrote to memory of 2472	2176	cmd.exe	35
PID 2176 wrote to memory of 2472	2176	cmd.exe	35
PID 2176 wrote to memory of 2472	2176	cmd.exe	35
PID 2176 wrote to memory of 2472	2176	cmd.exe	35
PID 2528 wrote to memory of 2252	2528	cmd.exe	37
PID 2528 wrote to memory of 2252	2528	cmd.exe	37
PID 2528 wrote to memory of 2252	2528	cmd.exe	37
PID 2528 wrote to memory of 2252	2528	cmd.exe	37
PID 2528 wrote to memory of 1536	2528	cmd.exe	38
PID 2528 wrote to memory of 1536	2528	cmd.exe	38
PID 2528 wrote to memory of 1536	2528	cmd.exe	38
PID 2528 wrote to memory of 1536	2528	cmd.exe	38

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\Hive Ransomware.exe
"C:\Users\Admin\AppData\Local\Temp\Hive Ransomware.exe"
1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2640
- C:\Windows\SysWOW64\cmd.exe
  cmd /c hive.bat >NUL 2>NUL
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2528
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:2612
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:2252
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:1536
- C:\Windows\SysWOW64\cmd.exe
  cmd /c shadow.bat >NUL 2>NUL
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2176
- - C:\Windows\SysWOW64\vssadmin.exe
    vssadmin.exe delete shadows /all /quiet
    3⤵
    - System Location Discovery: System Language Discovery
    - Interacts with shadow copies
    PID:2472

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2348

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-457978338-2990298471-2379561640-1000\desktop.ini

Filesize
129B

MD5
a526b9e7c716b3489d8cc062fbce4005

SHA1
2df502a944ff721241be20a9e449d2acd07e0312

SHA256
e1b9ce9b57957b1a0607a72a057d6b7a9b34ea60f3f8aa8f38a3af979bd23066

SHA512
d83d4c656c96c3d1809ad06ce78fa09a77781461c99109e4b81d1a186fc533a7e72d65a4cb7edf689eeccda8f687a13d3276f1111a1e72f7c3cd92a49bce0f88

Download Submit
C:\MSOCache\HOW_TO_DECRYPT.txt

Filesize
1KB

MD5
80207d0f8ea42bdfeaf9f5c586230aca

SHA1
747481fe2b0b6d81c3b19ba62d1e49eab6a5461f

SHA256
25edefb3b0678dfe0d927ff48ce67254359ba379df9468f634d02c026f0e7131

SHA512
73f68ce9e98d2346be1762bd54bb06ef83ae939dfbcf9b786d9b773fa454352613387d264b7a87a1c08950226553817bf01f5aa4107bc12de36a1689e2137304

Download Submit
C:\Users\Admin\AppData\Local\Temp\hive.bat

Filesize
184B

MD5
dc70612dee31a62e834e95709feaa5f7

SHA1
e3bbac5149ec5f27af0743d4fd332622920d518d

SHA256
07dc3fa1e68246d5a57206cf5ae3598a00049a80339bcd89db12fb1b10ba785c

SHA512
4a43ffae88b8026d272626aecb091a4177dec2ffc9f83999dc62499a2ecf80849580e32ddcbb40a57acca90e9dce1a9ab5712544fea96d4f68821c7bc39e1162

Download Submit
C:\Users\Admin\AppData\Local\Temp\shadow.bat

Filesize
57B

MD5
df5552357692e0cba5e69f8fbf06abb6

SHA1
4714f1e6bb75a80a8faf69434726d176b70d7bd8

SHA256
d158f9d53e7c37eadd3b5cc1b82d095f61484e47eda2c36d9d35f31c0b4d3ff8

SHA512
a837555a1175ab515e2b43da9e493ff0ccd4366ee59defe6770327818ca9afa6f3e39ecdf5262b69253aa9e2692283ee8cebc97d58edd42e676977c7f73d143d

Download Submit
memory/2640-0-0x0000000000BA0000-0x0000000000E03000-memory.dmp

Filesize
2.4MB

Download
memory/2640-1-0x0000000000BA0000-0x0000000000E03000-memory.dmp

Filesize
2.4MB

Download
memory/2640-2-0x0000000000BA0000-0x0000000000E03000-memory.dmp

Filesize
2.4MB

Download
memory/2640-3-0x0000000000BA0000-0x0000000000E03000-memory.dmp

Filesize
2.4MB

Download