hive | 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1

Analysis

max time kernel
30s
max time network
14s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
17-09-2024 02:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Hive Ransomware.exe
Size

764KB
MD5

2f9fc82898d718f2abe99c4a6fa79e69
SHA1

9d336b8911c8ffd7cc809e31d5b53796bb0cc7bb
SHA256

88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1
SHA512

19f0879b1c54d305ab7a97a0d46ab79c103d4687fe37d5f9ef1934904eea48a1c66b1ac2de3dace6dc0d91623309287044c198cb0b3fc9f8453fbc9d1c0cae8b
SSDEEP

12288:CinNFNkY/yU97ppM4NSBG81Np2C9H4S3iDjlLtc4wCIITIQaOI6NrwacVYV+4MsT:CinN3n/y67jM4v4kCSPDjlLtbwt8IQLH

Score

10^/10

hive discovery ransomware upx

Malware Config

Extracted

Path

C:\$Recycle.Bin\HOW_TO_DECRYPT.txt

Family

hive

Ransom Note

Your network has been breached and all data is encrypted. To decrypt all the data you will need to purchase our decryption software. Please contact our sales department at: http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/ Login: EQA9oydTxwXS Password: vNtgAgb3kMFmCooANNQr Follow the guidelines below to avoid losing your data: - Do not shutdown or reboot your computers, unmount external storages. - Do not try to decrypt data using third party software. It may cause irreversible damage. - Do not fool yourself. Encryption has perfect secrecy and it's impossible to decrypt without knowing the key. - Do not modify, rename or delete *.key.hive files. Your data will be undecryptable. - Do not modify or rename encrypted files. You will lose them. - Do not report to authorities. The negotiation process will be terminated immediately and the key will be erased. - Do not reject to purchase. Your sensitive data will be publicly disclosed at http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/

URLs

http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/

http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/

Signatures

Detects Go variant of Hive Ransomware 3 IoCs

resource	yara_rule
behavioral3/memory/4404-2-0x0000000000E10000-0x0000000001073000-memory.dmp	hive_go
behavioral3/memory/4404-1-0x0000000000E10000-0x0000000001073000-memory.dmp	hive_go
behavioral3/memory/4404-2433-0x0000000000E10000-0x0000000001073000-memory.dmp	hive_go

Hive
A ransomware written in Golang first seen in June 2021.
ransomware hive

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral3/memory/4404-0-0x0000000000E10000-0x0000000001073000-memory.dmp	upx
behavioral3/memory/4404-2-0x0000000000E10000-0x0000000001073000-memory.dmp	upx
behavioral3/memory/4404-1-0x0000000000E10000-0x0000000001073000-memory.dmp	upx
behavioral3/memory/4404-2433-0x0000000000E10000-0x0000000001073000-memory.dmp	upx

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-656926755-4116854191-210765258-1000\desktop.ini	Hive Ransomware.exe
File opened for modification	C:\$Recycle.Bin\S-1-5-21-656926755-4116854191-210765258-1000\desktop.ini	Hive Ransomware.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	Hive Ransomware.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_KMS_ClientC2R-ul.xrm-ms	Hive Ransomware.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-filesystem-l1-1-0.dll.mab1sTa8wlieG8wMuZKpeTv_VTVH7c4-vpNXxF0HmgM.hive	Hive Ransomware.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\Microsoft.Build.Conversion.v3.5.resources.dll	Hive Ransomware.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_KMS_Client-ul.xrm-ms.mab1sTa8wlieG8wMuZKpeRz-qvaov8NSAmrHPhM-5C8.hive	Hive Ransomware.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-root.xrm-ms.mab1sTa8wlieG8wMuZKpeS1uBzx8BswA4EI9aPBtzGo.hive	Hive Ransomware.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\SplashScreen.scale-200_contrast-black.png	Hive Ransomware.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\Office365LogoWLockup.scale-180.png	Hive Ransomware.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_OEM_Perp-ppd.xrm-ms	Hive Ransomware.exe
File created	C:\Program Files\VideoLAN\VLC\locale\tt\LC_MESSAGES\HOW_TO_DECRYPT.txt	Hive Ransomware.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\api-ms-win-crt-runtime-l1-1-0.dll	Hive Ransomware.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteSectionGroupLargeTile.scale-200.png	Hive Ransomware.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Assets\Audio\Skype_Shutter.m4a	Hive Ransomware.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Grace-ppd.xrm-ms.mab1sTa8wlieG8wMuZKpeSR_a6laGpVYWsbAvhr_1kQ.hive	Hive Ransomware.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVClientIsv.man	Hive Ransomware.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\oskclearuibase.xml	Hive Ransomware.exe
File opened for modification	C:\Program Files\Microsoft Office\PackageManifests\AuthoredExtensions.16.xml	Hive Ransomware.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib\OpenSSL64.DllA\openssl64.dlla.manifest.mab1sTa8wlieG8wMuZKpefNlWihyJsR5lTH3j6Mo_hg.hive	Hive Ransomware.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-24_altform-unplated.png	Hive Ransomware.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jfxwebkit.dll.mab1sTa8wlieG8wMuZKpeSaXo_sCzwlnN5vWYhgUHCE.hive	Hive Ransomware.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\LargeTile.scale-125_contrast-black.png	Hive Ransomware.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\LargeTile.scale-200_contrast-white.png	Hive Ransomware.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Trial-pl.xrm-ms.mab1sTa8wlieG8wMuZKpecd5591W8vpNW_KN-E_keTg.hive	Hive Ransomware.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\vcruntime140.dll	Hive Ransomware.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\nb.pak	Hive Ransomware.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-errorhandling-l1-1-0.dll.mab1sTa8wlieG8wMuZKpeXG2SZ0OUAscwiq8Yl-XJ20.hive	Hive Ransomware.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Viewpoints\Light\MilitaryLeft.png	Hive Ransomware.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Generic.xbf	Hive Ransomware.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Win10\MicrosoftSolitaireAppList.targetsize-256_altform-unplated_contrast-white_devicefamily-colorfulunplated.png	Hive Ransomware.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ucrtbase.dll.mab1sTa8wlieG8wMuZKpeStuIO9I6mVhWtecfy3b2SY.hive	Hive Ransomware.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Green Yellow.xml.mab1sTa8wlieG8wMuZKpeUyYp-oTfbxHhgrtIcEiInA.hive	Hive Ransomware.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\HOW_TO_DECRYPT.txt	Hive Ransomware.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Dial\Opacity.png	Hive Ransomware.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\animations\OneNoteFirstRunCarousel_Animation2.mp4	Hive Ransomware.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-processthreads-l1-1-1.dll.mab1sTa8wlieG8wMuZKpeb6lxGlMw197InqMwRGObnQ.hive	Hive Ransomware.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Trial-ppd.xrm-ms	Hive Ransomware.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\api-ms-win-crt-multibyte-l1-1-0.dll	Hive Ransomware.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ga\LC_MESSAGES\vlc.mo	Hive Ransomware.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Trial-pl.xrm-ms.mab1sTa8wlieG8wMuZKpecsbOC_ev40xGLVBxIrtVRk.hive	Hive Ransomware.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\resources\strings\LocalizedStrings_vi.json	Hive Ransomware.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-96.png	Hive Ransomware.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\ShapeCollector.exe.mui	Hive Ransomware.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteAppList.scale-125.png	Hive Ransomware.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\node_modules\reactxp-experimental-navigation\NavigationExperimental\assets\back-icon.png	Hive Ransomware.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jfxmedia.dll	Hive Ransomware.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Xml.Linq.dll	Hive Ransomware.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\es-ES\tabskb.dll.mui	Hive Ransomware.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Web.Entity.Design.Resources.dll	Hive Ransomware.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-heap-l1-1-0.dll	Hive Ransomware.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\WordR_Grace-ul-oob.xrm-ms.mab1sTa8wlieG8wMuZKpeQUUC6msn2ISIe5AlRS-7GQ.hive	Hive Ransomware.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\security\policy\unlimited\US_export_policy.jar.mab1sTa8wlieG8wMuZKpee4x3rv5rU41x8cd6k96HlM.hive	Hive Ransomware.exe
File opened for modification	C:\Program Files\Windows Media Player\de-DE\WMPMediaSharing.dll.mui	Hive Ransomware.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_2019.125.2243.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\AppxBundleManifest.xml	Hive Ransomware.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-black\BadgeLogo.scale-150_contrast-black.png	Hive Ransomware.exe
File opened for modification	C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md	Hive Ransomware.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\msvcp140_1.dll.mab1sTa8wlieG8wMuZKpeYCgE6k0UThQluAnHaoDYU0.hive	Hive Ransomware.exe
File opened for modification	C:\Program Files\Java\jre-1.8\legal\jdk\icu.md.mab1sTa8wlieG8wMuZKpeRqQbCzlspFVG7W6-_cFtUw.hive	Hive Ransomware.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libblend_plugin.dll	Hive Ransomware.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTest-pl.xrm-ms	Hive Ransomware.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PROOF\msgr8en.dub	Hive Ransomware.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\NativeShim.dll	Hive Ransomware.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxManifest.xml	Hive Ransomware.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_neutral_split.scale-100_8wekyb3d8bbwe\HOW_TO_DECRYPT.txt	Hive Ransomware.exe
File created	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example2.Diagnostics\1.0.1\Diagnostics\Simple\HOW_TO_DECRYPT.txt	Hive Ransomware.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Web Server Extensions\16\HOW_TO_DECRYPT.txt	Hive Ransomware.exe

System Location Discovery: System Language Discovery 1 TTPs 20 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hive Ransomware.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe

Delays execution with timeout.exe 17 IoCs

evasion

pid	Process
3172	timeout.exe
948	timeout.exe
100	timeout.exe
2456	timeout.exe
4020	timeout.exe
2292	timeout.exe
4792	timeout.exe
3020	timeout.exe
4696	timeout.exe
32	timeout.exe
1908	timeout.exe
3172	timeout.exe
1692	timeout.exe
4728	timeout.exe
1952	timeout.exe
1620	timeout.exe
1344	timeout.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4404	Hive Ransomware.exe
4404	Hive Ransomware.exe

Suspicious use of WriteProcessMemory 57 IoCs

description	pid	Process	procid_target
PID 4404 wrote to memory of 2424	4404	Hive Ransomware.exe	89
PID 4404 wrote to memory of 2424	4404	Hive Ransomware.exe	89
PID 4404 wrote to memory of 2424	4404	Hive Ransomware.exe	89
PID 4404 wrote to memory of 4480	4404	Hive Ransomware.exe	90
PID 4404 wrote to memory of 4480	4404	Hive Ransomware.exe	90
PID 4404 wrote to memory of 4480	4404	Hive Ransomware.exe	90
PID 2424 wrote to memory of 2292	2424	cmd.exe	93
PID 2424 wrote to memory of 2292	2424	cmd.exe	93
PID 2424 wrote to memory of 2292	2424	cmd.exe	93
PID 2424 wrote to memory of 32	2424	cmd.exe	94
PID 2424 wrote to memory of 32	2424	cmd.exe	94
PID 2424 wrote to memory of 32	2424	cmd.exe	94
PID 2424 wrote to memory of 3172	2424	cmd.exe	95
PID 2424 wrote to memory of 3172	2424	cmd.exe	95
PID 2424 wrote to memory of 3172	2424	cmd.exe	95
PID 2424 wrote to memory of 4792	2424	cmd.exe	96
PID 2424 wrote to memory of 4792	2424	cmd.exe	96
PID 2424 wrote to memory of 4792	2424	cmd.exe	96
PID 2424 wrote to memory of 4728	2424	cmd.exe	97
PID 2424 wrote to memory of 4728	2424	cmd.exe	97
PID 2424 wrote to memory of 4728	2424	cmd.exe	97
PID 2424 wrote to memory of 1952	2424	cmd.exe	98
PID 2424 wrote to memory of 1952	2424	cmd.exe	98
PID 2424 wrote to memory of 1952	2424	cmd.exe	98
PID 2424 wrote to memory of 1908	2424	cmd.exe	99
PID 2424 wrote to memory of 1908	2424	cmd.exe	99
PID 2424 wrote to memory of 1908	2424	cmd.exe	99
PID 2424 wrote to memory of 1620	2424	cmd.exe	100
PID 2424 wrote to memory of 1620	2424	cmd.exe	100
PID 2424 wrote to memory of 1620	2424	cmd.exe	100
PID 2424 wrote to memory of 3020	2424	cmd.exe	101
PID 2424 wrote to memory of 3020	2424	cmd.exe	101
PID 2424 wrote to memory of 3020	2424	cmd.exe	101
PID 2424 wrote to memory of 948	2424	cmd.exe	102
PID 2424 wrote to memory of 948	2424	cmd.exe	102
PID 2424 wrote to memory of 948	2424	cmd.exe	102
PID 2424 wrote to memory of 100	2424	cmd.exe	103
PID 2424 wrote to memory of 100	2424	cmd.exe	103
PID 2424 wrote to memory of 100	2424	cmd.exe	103
PID 2424 wrote to memory of 3172	2424	cmd.exe	104
PID 2424 wrote to memory of 3172	2424	cmd.exe	104
PID 2424 wrote to memory of 3172	2424	cmd.exe	104
PID 2424 wrote to memory of 1344	2424	cmd.exe	105
PID 2424 wrote to memory of 1344	2424	cmd.exe	105
PID 2424 wrote to memory of 1344	2424	cmd.exe	105
PID 2424 wrote to memory of 2456	2424	cmd.exe	106
PID 2424 wrote to memory of 2456	2424	cmd.exe	106
PID 2424 wrote to memory of 2456	2424	cmd.exe	106
PID 2424 wrote to memory of 4020	2424	cmd.exe	107
PID 2424 wrote to memory of 4020	2424	cmd.exe	107
PID 2424 wrote to memory of 4020	2424	cmd.exe	107
PID 2424 wrote to memory of 1692	2424	cmd.exe	108
PID 2424 wrote to memory of 1692	2424	cmd.exe	108
PID 2424 wrote to memory of 1692	2424	cmd.exe	108
PID 2424 wrote to memory of 4696	2424	cmd.exe	109
PID 2424 wrote to memory of 4696	2424	cmd.exe	109
PID 2424 wrote to memory of 4696	2424	cmd.exe	109

C:\Users\Admin\AppData\Local\Temp\Hive Ransomware.exe
"C:\Users\Admin\AppData\Local\Temp\Hive Ransomware.exe"
1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4404
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c hive.bat >NUL 2>NUL
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2424
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:2292
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:32
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:3172
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:4792
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:4728
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:1952
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:1908
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:1620
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:3020
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:948
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:100
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:3172
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:1344
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:2456
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:4020
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:1692
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:4696
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c shadow.bat >NUL 2>NUL
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\HOW_TO_DECRYPT.txt

Filesize
1KB

MD5
80207d0f8ea42bdfeaf9f5c586230aca

SHA1
747481fe2b0b6d81c3b19ba62d1e49eab6a5461f

SHA256
25edefb3b0678dfe0d927ff48ce67254359ba379df9468f634d02c026f0e7131

SHA512
73f68ce9e98d2346be1762bd54bb06ef83ae939dfbcf9b786d9b773fa454352613387d264b7a87a1c08950226553817bf01f5aa4107bc12de36a1689e2137304

Download Submit
C:\$Recycle.Bin\S-1-5-21-656926755-4116854191-210765258-1000\desktop.ini

Filesize
129B

MD5
a526b9e7c716b3489d8cc062fbce4005

SHA1
2df502a944ff721241be20a9e449d2acd07e0312

SHA256
e1b9ce9b57957b1a0607a72a057d6b7a9b34ea60f3f8aa8f38a3af979bd23066

SHA512
d83d4c656c96c3d1809ad06ce78fa09a77781461c99109e4b81d1a186fc533a7e72d65a4cb7edf689eeccda8f687a13d3276f1111a1e72f7c3cd92a49bce0f88

Download Submit
C:\Users\Admin\AppData\Local\Temp\hive.bat

Filesize
184B

MD5
dc70612dee31a62e834e95709feaa5f7

SHA1
e3bbac5149ec5f27af0743d4fd332622920d518d

SHA256
07dc3fa1e68246d5a57206cf5ae3598a00049a80339bcd89db12fb1b10ba785c

SHA512
4a43ffae88b8026d272626aecb091a4177dec2ffc9f83999dc62499a2ecf80849580e32ddcbb40a57acca90e9dce1a9ab5712544fea96d4f68821c7bc39e1162

Download Submit
C:\Users\Admin\AppData\Local\Temp\shadow.bat

Filesize
57B

MD5
df5552357692e0cba5e69f8fbf06abb6

SHA1
4714f1e6bb75a80a8faf69434726d176b70d7bd8

SHA256
d158f9d53e7c37eadd3b5cc1b82d095f61484e47eda2c36d9d35f31c0b4d3ff8

SHA512
a837555a1175ab515e2b43da9e493ff0ccd4366ee59defe6770327818ca9afa6f3e39ecdf5262b69253aa9e2692283ee8cebc97d58edd42e676977c7f73d143d

Download Submit
memory/4404-0-0x0000000000E10000-0x0000000001073000-memory.dmp

Filesize
2.4MB

Download
memory/4404-2-0x0000000000E10000-0x0000000001073000-memory.dmp

Filesize
2.4MB

Download
memory/4404-1-0x0000000000E10000-0x0000000001073000-memory.dmp

Filesize
2.4MB

Download
memory/4404-2433-0x0000000000E10000-0x0000000001073000-memory.dmp

Filesize
2.4MB

Download