Analysis
-
max time kernel
30s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system -
submitted
17-09-2024 02:21
Behavioral task
behavioral1
Sample
Hive Ransomware.exe
Resource
win7-20240903-en
windows7-x64
13 signatures
30 seconds
Behavioral task
behavioral2
Sample
Hive Ransomware.exe
Resource
win10-20240611-en
windows10-1703-x64
9 signatures
30 seconds
Behavioral task
behavioral3
Sample
Hive Ransomware.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
9 signatures
30 seconds
Behavioral task
behavioral4
Sample
Hive Ransomware.exe
Resource
win11-20240802-en
windows11-21h2-x64
9 signatures
30 seconds
General
-
Target
Hive Ransomware.exe
-
Size
764KB
-
MD5
2f9fc82898d718f2abe99c4a6fa79e69
-
SHA1
9d336b8911c8ffd7cc809e31d5b53796bb0cc7bb
-
SHA256
88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1
-
SHA512
19f0879b1c54d305ab7a97a0d46ab79c103d4687fe37d5f9ef1934904eea48a1c66b1ac2de3dace6dc0d91623309287044c198cb0b3fc9f8453fbc9d1c0cae8b
-
SSDEEP
12288:CinNFNkY/yU97ppM4NSBG81Np2C9H4S3iDjlLtc4wCIITIQaOI6NrwacVYV+4MsT:CinN3n/y67jM4v4kCSPDjlLtbwt8IQLH
Score
10/10
Malware Config
Extracted
Path
C:\$Recycle.Bin\HOW_TO_DECRYPT.txt
Family
hive
Ransom Note
Your network has been breached and all data is encrypted.
To decrypt all the data you will need to purchase our decryption software.
Please contact our sales department at:
http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/
Login: EQA9oydTxwXS
Password: vNtgAgb3kMFmCooANNQr
Follow the guidelines below to avoid losing your data:
- Do not shutdown or reboot your computers, unmount external storages.
- Do not try to decrypt data using third party software. It may cause irreversible damage.
- Do not fool yourself. Encryption has perfect secrecy and it's impossible to decrypt without knowing the key.
- Do not modify, rename or delete *.key.hive files. Your data will be undecryptable.
- Do not modify or rename encrypted files. You will lose them.
- Do not report to authorities. The negotiation process will be terminated immediately and the key will be erased.
- Do not reject to purchase. Your sensitive data will be publicly disclosed at http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/
URLs
http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/
http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/
Signatures
-
Detects Go variant of Hive Ransomware 3 IoCs
resource yara_rule behavioral4/memory/912-1-0x00000000002E0000-0x0000000000543000-memory.dmp hive_go behavioral4/memory/912-2-0x00000000002E0000-0x0000000000543000-memory.dmp hive_go behavioral4/memory/912-2130-0x00000000002E0000-0x0000000000543000-memory.dmp hive_go -
Hive
A ransomware written in Golang first seen in June 2021.
-
resource yara_rule behavioral4/memory/912-0-0x00000000002E0000-0x0000000000543000-memory.dmp upx behavioral4/memory/912-1-0x00000000002E0000-0x0000000000543000-memory.dmp upx behavioral4/memory/912-2-0x00000000002E0000-0x0000000000543000-memory.dmp upx behavioral4/memory/912-2130-0x00000000002E0000-0x0000000000543000-memory.dmp upx -
Drops desktop.ini file(s) 3 IoCs
description ioc Process File opened for modification F:\$RECYCLE.BIN\S-1-5-21-4272559161-3282441186-401869126-1000\desktop.ini Hive Ransomware.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-4272559161-3282441186-401869126-1000\desktop.ini Hive Ransomware.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI Hive Ransomware.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail-ppd.xrm-ms.CSQi6f9nvsbrKxtf2-SXAnBxusBrSHtENi2S5iXxvyw.hive Hive Ransomware.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.2008.32311.0_x64__8wekyb3d8bbwe\Assets\contrast-black\GetHelpAppList.targetsize-48_contrast-black.png Hive Ransomware.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\assembly\GAC_MSIL\Microsoft.AnalysisServices.SPClient.Interfaces\HOW_TO_DECRYPT.txt Hive Ransomware.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL016.XML Hive Ransomware.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_KMS_ClientC2R-ppd.xrm-ms.CSQi6f9nvsbrKxtf2-SXApG0QNyqs8IVuCNvl_C_ElU.hive Hive Ransomware.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageAppList.targetsize-80_contrast-white.png Hive Ransomware.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL044.XML.CSQi6f9nvsbrKxtf2-SXAq-gu6-exf5B_npKNFkJdmA.hive Hive Ransomware.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Paint_10.2104.17.0_x64__8wekyb3d8bbwe\Assets\PaintAppList.targetsize-60_altform-lightunplated.png Hive Ransomware.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\dt_socket.dll Hive Ransomware.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CSIRESOURCES.DLL Hive Ransomware.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\MSSRINTL.DLL Hive Ransomware.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_Subscription-ppd.xrm-ms.CSQi6f9nvsbrKxtf2-SXAmFMtzzXWgJMmK-_DrhWuQE.hive Hive Ransomware.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\HOW_TO_DECRYPT.txt Hive Ransomware.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE.CSQi6f9nvsbrKxtf2-SXApyEYSmR_yYuSCvy48ZB7h8.hive Hive Ransomware.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe.CSQi6f9nvsbrKxtf2-SXAhdG7fqt94UpmDJHpObTWV0.hive Hive Ransomware.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\ext\sunpkcs11.jar Hive Ransomware.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ODBC32.DLL Hive Ransomware.exe File created C:\Program Files\Common Files\microsoft shared\ink\uk-UA\HOW_TO_DECRYPT.txt Hive Ransomware.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_KMS_Client-ul-oob.xrm-ms Hive Ransomware.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.6.3102.0_x64__8wekyb3d8bbwe\Microsoft.Advertising.winmd Hive Ransomware.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] Hive Ransomware.exe File opened for modification C:\Program Files\Microsoft Office\root\Office15\pidgenx.dll.CSQi6f9nvsbrKxtf2-SXAhrAR7WA1n4cKPZsVC6rdGs.hive Hive Ransomware.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\TellMeExcel.nrr.CSQi6f9nvsbrKxtf2-SXAv2ksnYTUVAzQNpUDPsjhmI.hive Hive Ransomware.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SyncFusion.Core.dll Hive Ransomware.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OFFRHD.DLL.CSQi6f9nvsbrKxtf2-SXAlboUSQ-oWdwosbyD9IDdFQ.hive Hive Ransomware.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Paint_10.2104.17.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\PaintStoreLogo.scale-100.png Hive Ransomware.exe File opened for modification C:\Program Files\7-Zip\Lang\sr-spl.txt Hive Ransomware.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_KMS_Client_AE-ppd.xrm-ms Hive Ransomware.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libmpgv_plugin.dll Hive Ransomware.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsNotepad_10.2102.13.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\NotepadAppList.scale-125.png Hive Ransomware.exe File created C:\Program Files\WindowsApps\Microsoft.Paint_10.2104.17.0_x64__8wekyb3d8bbwe\AppxMetadata\HOW_TO_DECRYPT.txt Hive Ransomware.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial2-ul-oob.xrm-ms.CSQi6f9nvsbrKxtf2-SXAgGF5a73rKpT4tCqW32pMVI.hive Hive Ransomware.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.scale-180.png Hive Ransomware.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_MAKC2R-ul-phn.xrm-ms.CSQi6f9nvsbrKxtf2-SXAruGnLn4Q4pQx4QR0umjHls.hive Hive Ransomware.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\en-us\HOW_TO_DECRYPT.txt Hive Ransomware.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_4.0.2.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\Icons\StickyNotesBadgeLogo.scale-100_contrast-white.png Hive Ransomware.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\HOW_TO_DECRYPT.txt Hive Ransomware.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\security\trusted.libraries Hive Ransomware.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_MAK-ppd.xrm-ms.CSQi6f9nvsbrKxtf2-SXApRXnQbhEfhJHI2hJ3lO_Ck.hive Hive Ransomware.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Paint_10.2104.17.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\PaintWideTile.scale-125.png Hive Ransomware.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.2104.12721.0_x64__8wekyb3d8bbwe\System.Runtime.Serialization.dll Hive Ransomware.exe File opened for modification C:\Program Files\Microsoft Office\root\rsod\excelmui.msi.16.en-us.boot.tree.dat Hive Ransomware.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\C2RManifest.proofing.msi.16.en-us.xml.CSQi6f9nvsbrKxtf2-SXAls6O7IvEh1Ff99CjVr_vD4.hive Hive Ransomware.exe File created C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\th-TH\HOW_TO_DECRYPT.txt Hive Ransomware.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GamingApp_2105.900.24.0_x64__8wekyb3d8bbwe\AppxMetadata\CodeIntegrity.cat Hive Ransomware.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.6.3102.0_x64__8wekyb3d8bbwe\Win10\MicrosoftSolitaireAppList.targetsize-256_contrast-black.png Hive Ransomware.exe File created C:\Program Files\VideoLAN\VLC\locale\as_IN\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\Resources\en-us\HOW_TO_DECRYPT.txt Hive Ransomware.exe File opened for modification C:\Program Files\Mozilla Firefox\dependentlibs.list Hive Ransomware.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_21.21030.25003.0_x64__8wekyb3d8bbwe\AppxMetadata\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\HOW_TO_DECRYPT.txt Hive Ransomware.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp5-ppd.xrm-ms Hive Ransomware.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART8.BDR Hive Ransomware.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\HOW_TO_DECRYPT.txt Hive Ransomware.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.2008.32311.0_x64__8wekyb3d8bbwe\Assets\contrast-white\GetHelpSplashScreen.scale-200_contrast-white.png Hive Ransomware.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-processthreads-l1-1-0.dll Hive Ransomware.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-black_scale-80.png.CSQi6f9nvsbrKxtf2-SXAkAEbQJOa1kCRh5V-dUSomw.hive Hive Ransomware.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sl-si.dll.CSQi6f9nvsbrKxtf2-SXArR5W63CWSJxoQJuvkEwb0s.hive Hive Ransomware.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\123.0.6312.122.manifest Hive Ransomware.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\VSTOLoaderUI.dll Hive Ransomware.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\HOW_TO_DECRYPT.txt Hive Ransomware.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.2104.12721.0_neutral_split.scale-100_8wekyb3d8bbwe\Images\Wide310x150Logo.scale-100.png Hive Ransomware.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial-ul-oob.xrm-ms.CSQi6f9nvsbrKxtf2-SXAnIvFgYDbAxDYxE1m3n1HHk.hive Hive Ransomware.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_OEM_Perp-ul-oob.xrm-ms.CSQi6f9nvsbrKxtf2-SXAg57wHm_DuUNI0H3YTL4PGY.hive Hive Ransomware.exe -
System Location Discovery: System Language Discovery 1 TTPs 20 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hive Ransomware.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe -
Delays execution with timeout.exe 18 IoCs
pid Process 3860 timeout.exe 5004 timeout.exe 1340 timeout.exe 3880 timeout.exe 1044 timeout.exe 364 timeout.exe 2104 timeout.exe 5072 timeout.exe 1376 timeout.exe 1380 timeout.exe 884 timeout.exe 1828 timeout.exe 2584 timeout.exe 4568 timeout.exe 4764 timeout.exe 3136 timeout.exe 3324 timeout.exe 936 timeout.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 912 Hive Ransomware.exe 912 Hive Ransomware.exe -
Suspicious use of WriteProcessMemory 60 IoCs
description pid Process procid_target PID 912 wrote to memory of 2768 912 Hive Ransomware.exe 81 PID 912 wrote to memory of 2768 912 Hive Ransomware.exe 81 PID 912 wrote to memory of 2768 912 Hive Ransomware.exe 81 PID 912 wrote to memory of 472 912 Hive Ransomware.exe 82 PID 912 wrote to memory of 472 912 Hive Ransomware.exe 82 PID 912 wrote to memory of 472 912 Hive Ransomware.exe 82 PID 2768 wrote to memory of 2584 2768 cmd.exe 85 PID 2768 wrote to memory of 2584 2768 cmd.exe 85 PID 2768 wrote to memory of 2584 2768 cmd.exe 85 PID 2768 wrote to memory of 936 2768 cmd.exe 86 PID 2768 wrote to memory of 936 2768 cmd.exe 86 PID 2768 wrote to memory of 936 2768 cmd.exe 86 PID 2768 wrote to memory of 5072 2768 cmd.exe 87 PID 2768 wrote to memory of 5072 2768 cmd.exe 87 PID 2768 wrote to memory of 5072 2768 cmd.exe 87 PID 2768 wrote to memory of 4568 2768 cmd.exe 88 PID 2768 wrote to memory of 4568 2768 cmd.exe 88 PID 2768 wrote to memory of 4568 2768 cmd.exe 88 PID 2768 wrote to memory of 1340 2768 cmd.exe 89 PID 2768 wrote to memory of 1340 2768 cmd.exe 89 PID 2768 wrote to memory of 1340 2768 cmd.exe 89 PID 2768 wrote to memory of 4764 2768 cmd.exe 90 PID 2768 wrote to memory of 4764 2768 cmd.exe 90 PID 2768 wrote to memory of 4764 2768 cmd.exe 90 PID 2768 wrote to memory of 3880 2768 cmd.exe 91 PID 2768 wrote to memory of 3880 2768 cmd.exe 91 PID 2768 wrote to memory of 3880 2768 cmd.exe 91 PID 2768 wrote to memory of 1376 2768 cmd.exe 92 PID 2768 wrote to memory of 1376 2768 cmd.exe 92 PID 2768 wrote to memory of 1376 2768 cmd.exe 92 PID 2768 wrote to memory of 1380 2768 cmd.exe 93 PID 2768 wrote to memory of 1380 2768 cmd.exe 93 PID 2768 wrote to memory of 1380 2768 cmd.exe 93 PID 2768 wrote to memory of 1044 2768 cmd.exe 94 PID 2768 wrote to memory of 1044 2768 cmd.exe 94 PID 2768 wrote to memory of 1044 2768 cmd.exe 94 PID 2768 wrote to memory of 3136 2768 cmd.exe 95 PID 2768 wrote to memory of 3136 2768 cmd.exe 95 PID 2768 wrote to memory of 3136 2768 cmd.exe 95 PID 2768 wrote to memory of 3324 2768 cmd.exe 96 PID 2768 wrote to memory of 3324 2768 cmd.exe 96 PID 2768 wrote to memory of 3324 2768 cmd.exe 96 PID 2768 wrote to memory of 884 2768 cmd.exe 97 PID 2768 wrote to memory of 884 2768 cmd.exe 97 PID 2768 wrote to memory of 884 2768 cmd.exe 97 PID 2768 wrote to memory of 1828 2768 cmd.exe 98 PID 2768 wrote to memory of 1828 2768 cmd.exe 98 PID 2768 wrote to memory of 1828 2768 cmd.exe 98 PID 2768 wrote to memory of 3860 2768 cmd.exe 99 PID 2768 wrote to memory of 3860 2768 cmd.exe 99 PID 2768 wrote to memory of 3860 2768 cmd.exe 99 PID 2768 wrote to memory of 5004 2768 cmd.exe 100 PID 2768 wrote to memory of 5004 2768 cmd.exe 100 PID 2768 wrote to memory of 5004 2768 cmd.exe 100 PID 2768 wrote to memory of 364 2768 cmd.exe 101 PID 2768 wrote to memory of 364 2768 cmd.exe 101 PID 2768 wrote to memory of 364 2768 cmd.exe 101 PID 2768 wrote to memory of 2104 2768 cmd.exe 102 PID 2768 wrote to memory of 2104 2768 cmd.exe 102 PID 2768 wrote to memory of 2104 2768 cmd.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\Hive Ransomware.exe"C:\Users\Admin\AppData\Local\Temp\Hive Ransomware.exe"1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c hive.bat >NUL 2>NUL2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2584
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:936
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:5072
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:4568
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:1340
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:4764
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:3880
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:1376
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:1380
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:1044
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:3136
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:3324
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:884
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:1828
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:3860
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:5004
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:364
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:2104
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c shadow.bat >NUL 2>NUL2⤵
- System Location Discovery: System Language Discovery
PID:472
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD580207d0f8ea42bdfeaf9f5c586230aca
SHA1747481fe2b0b6d81c3b19ba62d1e49eab6a5461f
SHA25625edefb3b0678dfe0d927ff48ce67254359ba379df9468f634d02c026f0e7131
SHA51273f68ce9e98d2346be1762bd54bb06ef83ae939dfbcf9b786d9b773fa454352613387d264b7a87a1c08950226553817bf01f5aa4107bc12de36a1689e2137304
-
Filesize
129B
MD5f387196b087b99ca7f2b42fc75b0de95
SHA13f534719c3d45f0a08d0302ba6fb845aa1f6b915
SHA256cb9b4f60fa190efa0223704ff2f02e736b9cf4e0c1feaf958f7f732dce2df523
SHA512558ae03b3693052a9e2fc512bc1cd7c80ee61f77c649142ea86c7ec12fdcdf4d37298d91cd61d1b6eae294f7d044f15ac621c83016ad134cfaba7c17f0bcdcf0
-
Filesize
184B
MD5dc70612dee31a62e834e95709feaa5f7
SHA1e3bbac5149ec5f27af0743d4fd332622920d518d
SHA25607dc3fa1e68246d5a57206cf5ae3598a00049a80339bcd89db12fb1b10ba785c
SHA5124a43ffae88b8026d272626aecb091a4177dec2ffc9f83999dc62499a2ecf80849580e32ddcbb40a57acca90e9dce1a9ab5712544fea96d4f68821c7bc39e1162
-
Filesize
57B
MD5df5552357692e0cba5e69f8fbf06abb6
SHA14714f1e6bb75a80a8faf69434726d176b70d7bd8
SHA256d158f9d53e7c37eadd3b5cc1b82d095f61484e47eda2c36d9d35f31c0b4d3ff8
SHA512a837555a1175ab515e2b43da9e493ff0ccd4366ee59defe6770327818ca9afa6f3e39ecdf5262b69253aa9e2692283ee8cebc97d58edd42e676977c7f73d143d