Analysis
-
max time kernel
74s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
11/03/2025, 10:09
Behavioral task
behavioral1
Sample
Hive Ransomware.exe
Resource
win7-20240903-en
windows7-x64
26 signatures
150 seconds
Behavioral task
behavioral2
Sample
Hive Ransomware.exe
Resource
win10v2004-20250217-en
windows10-2004-x64
25 signatures
150 seconds
General
-
Target
Hive Ransomware.exe
-
Size
764KB
-
MD5
2f9fc82898d718f2abe99c4a6fa79e69
-
SHA1
9d336b8911c8ffd7cc809e31d5b53796bb0cc7bb
-
SHA256
88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1
-
SHA512
19f0879b1c54d305ab7a97a0d46ab79c103d4687fe37d5f9ef1934904eea48a1c66b1ac2de3dace6dc0d91623309287044c198cb0b3fc9f8453fbc9d1c0cae8b
-
SSDEEP
12288:CinNFNkY/yU97ppM4NSBG81Np2C9H4S3iDjlLtc4wCIITIQaOI6NrwacVYV+4MsT:CinN3n/y67jM4v4kCSPDjlLtbwt8IQLH
Malware Config
Extracted
Path
C:\MSOCache\HOW_TO_DECRYPT.txt
Family
hive
Ransom Note
Your network has been breached and all data is encrypted.
To decrypt all the data you will need to purchase our decryption software.
Please contact our sales department at:
http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/
Login: EQA9oydTxwXS
Password: vNtgAgb3kMFmCooANNQr
Follow the guidelines below to avoid losing your data:
- Do not shutdown or reboot your computers, unmount external storages.
- Do not try to decrypt data using third party software. It may cause irreversible damage.
- Do not fool yourself. Encryption has perfect secrecy and it's impossible to decrypt without knowing the key.
- Do not modify, rename or delete *.key.hive files. Your data will be undecryptable.
- Do not modify or rename encrypted files. You will lose them.
- Do not report to authorities. The negotiation process will be terminated immediately and the key will be erased.
- Do not reject to purchase. Your sensitive data will be publicly disclosed at http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/
URLs
http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/
http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/
Signatures
-
Detects Go variant of Hive Ransomware 8 IoCs
resource yara_rule behavioral1/memory/2392-13-0x0000000001370000-0x00000000015D3000-memory.dmp hive_go behavioral1/memory/2392-14-0x0000000001370000-0x00000000015D3000-memory.dmp hive_go behavioral1/memory/2392-2857-0x0000000001370000-0x00000000015D3000-memory.dmp hive_go behavioral1/memory/2392-6649-0x0000000001370000-0x00000000015D3000-memory.dmp hive_go behavioral1/memory/2392-10887-0x0000000001370000-0x00000000015D3000-memory.dmp hive_go behavioral1/memory/2392-11964-0x0000000001370000-0x00000000015D3000-memory.dmp hive_go behavioral1/memory/2392-14740-0x0000000001370000-0x00000000015D3000-memory.dmp hive_go behavioral1/memory/2392-15939-0x0000000001370000-0x00000000015D3000-memory.dmp hive_go -
Hive
A ransomware written in Golang first seen in June 2021.
-
Hive family
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Drops file in Drivers directory 28 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\drivers\en-US\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\SysWOW64\drivers\UMDF\ja-JP\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\SysWOW64\drivers\de-DE\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\SysWOW64\drivers\ja-JP\HOW_TO_DECRYPT.txt Hive Ransomware.exe File opened for modification C:\Windows\SysWOW64\drivers\UMDF\HOW_TO_DECRYPT.txt Hive Ransomware.exe File opened for modification C:\Windows\SysWOW64\drivers\UMDF\es-ES\HOW_TO_DECRYPT.txt Hive Ransomware.exe File opened for modification C:\Windows\SysWOW64\drivers\ja-JP\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\SysWOW64\drivers\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\SysWOW64\drivers\UMDF\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\SysWOW64\drivers\UMDF\de-DE\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\SysWOW64\drivers\UMDF\en-US\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\SysWOW64\drivers\es-ES\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\SysWOW64\drivers\it-IT\HOW_TO_DECRYPT.txt Hive Ransomware.exe File opened for modification C:\Windows\SysWOW64\drivers\HOW_TO_DECRYPT.txt Hive Ransomware.exe File opened for modification C:\Windows\SysWOW64\drivers\UMDF\ja-JP\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\SysWOW64\drivers\UMDF\fr-FR\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\SysWOW64\drivers\en-US\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\SysWOW64\drivers\fr-FR\HOW_TO_DECRYPT.txt Hive Ransomware.exe File opened for modification C:\Windows\SysWOW64\drivers\UMDF\en-US\HOW_TO_DECRYPT.txt Hive Ransomware.exe File opened for modification C:\Windows\SysWOW64\drivers\UMDF\fr-FR\HOW_TO_DECRYPT.txt Hive Ransomware.exe File opened for modification C:\Windows\SysWOW64\drivers\es-ES\HOW_TO_DECRYPT.txt Hive Ransomware.exe File opened for modification C:\Windows\SysWOW64\drivers\fr-FR\HOW_TO_DECRYPT.txt Hive Ransomware.exe File opened for modification C:\Windows\SysWOW64\drivers\it-IT\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\SysWOW64\drivers\UMDF\es-ES\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\SysWOW64\drivers\UMDF\it-IT\HOW_TO_DECRYPT.txt Hive Ransomware.exe File opened for modification C:\Windows\SysWOW64\drivers\UMDF\de-DE\HOW_TO_DECRYPT.txt Hive Ransomware.exe File opened for modification C:\Windows\SysWOW64\drivers\UMDF\it-IT\HOW_TO_DECRYPT.txt Hive Ransomware.exe File opened for modification C:\Windows\SysWOW64\drivers\de-DE\HOW_TO_DECRYPT.txt Hive Ransomware.exe -
Drops startup file 3 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini Hive Ransomware.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\HOW_TO_DECRYPT.txt Hive Ransomware.exe -
Loads dropped DLL 15 IoCs
pid Process 2536 MsiExec.exe 2536 MsiExec.exe 2536 MsiExec.exe 2536 MsiExec.exe 1520 msiexec.exe 1520 msiexec.exe 1520 msiexec.exe 1520 msiexec.exe 2536 MsiExec.exe 2536 MsiExec.exe 2536 MsiExec.exe 2536 MsiExec.exe 1520 msiexec.exe 1520 msiexec.exe 1336 MsiExec.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 64 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\HUSZWRNT\desktop.ini Hive Ransomware.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini Hive Ransomware.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini Hive Ransomware.exe File opened for modification C:\Users\Admin\Documents\desktop.ini Hive Ransomware.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-2872745919-2748461613-2989606286-1000\desktop.ini Hive Ransomware.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-2872745919-2748461613-2989606286-1000\desktop.ini Hive Ransomware.exe File opened for modification C:\Program Files\desktop.ini Hive Ransomware.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini Hive Ransomware.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini Hive Ransomware.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini Hive Ransomware.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini Hive Ransomware.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\M1ITRGY5\desktop.ini Hive Ransomware.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini Hive Ransomware.exe File opened for modification C:\Users\Admin\Links\desktop.ini Hive Ransomware.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini Hive Ransomware.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini Hive Ransomware.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\desktop.ini Hive Ransomware.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini Hive Ransomware.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini Hive Ransomware.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\desktop.ini Hive Ransomware.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini Hive Ransomware.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini Hive Ransomware.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini Hive Ransomware.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini Hive Ransomware.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini Hive Ransomware.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini Hive Ransomware.exe File opened for modification C:\Users\Public\Documents\desktop.ini Hive Ransomware.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini Hive Ransomware.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini Hive Ransomware.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini Hive Ransomware.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini Hive Ransomware.exe File opened for modification C:\ProgramData\Microsoft\Windows\Ringtones\desktop.ini Hive Ransomware.exe File opened for modification C:\Users\Admin\Music\desktop.ini Hive Ransomware.exe File opened for modification C:\Users\Public\Videos\desktop.ini Hive Ransomware.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini Hive Ransomware.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini Hive Ransomware.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini Hive Ransomware.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini Hive Ransomware.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini Hive Ransomware.exe File opened for modification C:\Users\Public\Music\desktop.ini Hive Ransomware.exe File opened for modification C:\Users\Public\desktop.ini Hive Ransomware.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\desktop.ini Hive Ransomware.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini Hive Ransomware.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini Hive Ransomware.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\OIPA882W\desktop.ini Hive Ransomware.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini Hive Ransomware.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini Hive Ransomware.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini Hive Ransomware.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\desktop.ini Hive Ransomware.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI Hive Ransomware.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini Hive Ransomware.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini Hive Ransomware.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini Hive Ransomware.exe File opened for modification C:\Users\Admin\Searches\desktop.ini Hive Ransomware.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\desktop.ini Hive Ransomware.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\F17E26FP\desktop.ini Hive Ransomware.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini Hive Ransomware.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini Hive Ransomware.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini Hive Ransomware.exe File opened for modification C:\Users\Admin\Videos\desktop.ini Hive Ransomware.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini Hive Ransomware.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\Desktop.ini Hive Ransomware.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini Hive Ransomware.exe File opened for modification C:\Users\Public\Downloads\desktop.ini Hive Ransomware.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\InstallShield\setupdir\001b\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\SysWOW64\IME\IMETC10\applets\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\SysWOW64\Dism\de-DE\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmdyna.inf_amd64_neutral_7e4d690d07ee94c1\HOW_TO_DECRYPT.txt Hive Ransomware.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\HOW_TO_DECRYPT.txt Hive Ransomware.exe File opened for modification C:\Windows\SysWOW64\oobe\it-IT\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\System32\DriverStore\FileRepository\hal.inf_amd64_neutral_232b95977cf6d84c\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\System32\DriverStore\FileRepository\machine.inf_amd64_neutral_a2f120466549d68b\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\System32\DriverStore\FileRepository\prngt002.inf_amd64_neutral_df2060d80de9ff13\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\System32\DriverStore\FileRepository\prnso002.inf_amd64_neutral_c3b7ce4e6f71641f\Amd64\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\System32\DriverStore\FileRepository\wiabr008.inf_amd64_neutral_27d1c9a28eac4eed\HOW_TO_DECRYPT.txt Hive Ransomware.exe File opened for modification C:\Windows\SysWOW64\IME\imekr8\HOW_TO_DECRYPT.txt Hive Ransomware.exe File opened for modification C:\Windows\SysWOW64\MUI\040C\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitsTransfer\fr-FR\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\SysWOW64\en-US\Licenses\_Default\StarterE\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\SysWOW64\ja-JP\Licenses\_Default\HomePremiumN\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmaiwa.inf_amd64_neutral_560c956da9bcd8f5\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\System32\DriverStore\FileRepository\prnrc302.inf_amd64_ja-jp_64ee91a0bf7b132c\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\System32\DriverStore\FileRepository\wudfusbcciddriver.inf_amd64_neutral_adc3e4acb1046b4b\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\SysWOW64\wdi\perftrack\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\System32\DriverStore\FileRepository\ph3xibc7.inf_amd64_neutral_348f512722c79525\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\System32\DriverStore\FileRepository\prnrc003.inf_amd64_neutral_47e09b7cc0d9e993\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\System32\DriverStore\FileRepository\usbport.inf_amd64_neutral_f935002f367d5bb0\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\System32\DriverStore\FileRepository\wialx003.inf_amd64_neutral_db618863f9347f9a\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\SysWOW64\el-GR\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\SysWOW64\it-IT\Licenses\_Default\Professional\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\SysWOW64\migration\it-IT\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\System32\DriverStore\FileRepository\prnky305.inf_amd64_ja-jp_4d77cc4802b17ec3\Amd64\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\System32\DriverStore\FileRepository\prnms002.inf_amd64_neutral_d834e48846616289\Amd64\HOW_TO_DECRYPT.txt Hive Ransomware.exe File opened for modification C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-Windows-International-Core-DL\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmaiwa4.inf_amd64_neutral_6e97842bb8d9e6a8\HOW_TO_DECRYPT.txt Hive Ransomware.exe File opened for modification C:\Windows\SysWOW64\MUI\0C0A\HOW_TO_DECRYPT.txt Hive Ransomware.exe File opened for modification C:\Windows\SysWOW64\fr-FR\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\System32\DriverStore\FileRepository\bthpan.inf_amd64_neutral_024281c0e4e954e2\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmmetri.inf_amd64_neutral_f89b8a357327f615\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\System32\DriverStore\FileRepository\prncs302.inf_amd64_ja-jp_96eca15be06b1482\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\System32\DriverStore\FileRepository\prnhp005.inf_amd64_neutral_914d6c300207814f\Amd64\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\SysWOW64\InstallShield\setupdir\001f\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\System32\DriverStore\FileRepository\prnxx002.inf_amd64_neutral_560fdd891b24f384\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\SysWOW64\migwiz\replacementmanifests\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\SysWOW64\en-US\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\SysWOW64\slmgr\040C\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\System32\DriverStore\FileRepository\prnlx00a.inf_amd64_neutral_a89d2c01c0f43dfd\Amd64\HOW_TO_DECRYPT.txt Hive Ransomware.exe File opened for modification C:\Windows\SysWOW64\migwiz\PostMigRes\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\System32\DriverStore\FileRepository\bthspp.inf_amd64_neutral_1b15060bdfbd09e1\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmnttp.inf_amd64_neutral_18b899bdc8a755fa\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\System32\DriverStore\FileRepository\prnky004.inf_amd64_neutral_5db759db19acd3ae\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\System32\DriverStore\FileRepository\usb.inf_amd64_neutral_269d7150439b3372\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\System32\DriverStore\FileRepository\wdmvsc.inf_amd64_neutral_a2cf745000e2ea92\HOW_TO_DECRYPT.txt Hive Ransomware.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\SysWOW64\WCN\ja-JP\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitsTransfer\it-IT\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\SysWOW64\fr-FR\Licenses\OEM\ProfessionalN\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\System32\DriverStore\FileRepository\digitalmediadevice.inf_amd64_neutral_6fd673519d66ab20\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmzyxlg.inf_amd64_neutral_14f9249844f1cf17\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\System32\DriverStore\FileRepository\prnbr004.inf_amd64_neutral_a78e168d6944619a\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\System32\DriverStore\FileRepository\xnacc.inf_amd64_neutral_13c4e272a96185a1\HOW_TO_DECRYPT.txt Hive Ransomware.exe File opened for modification C:\Windows\SysWOW64\migration\WSMT\rras\dlmanifests\Microsoft-Windows-RasServer-MigPlugin\HOW_TO_DECRYPT.txt Hive Ransomware.exe File opened for modification C:\Windows\SysWOW64\Dism\en-US\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\System32\DriverStore\FileRepository\bthprint.inf_amd64_neutral_3c11362fa327f5a4\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\System32\DriverStore\FileRepository\netbxnda.inf_amd64_neutral_c81780c5dcabd0a0\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\System32\DriverStore\FileRepository\prnts003.inf_amd64_neutral_33a68664c7e7ae4b\HOW_TO_DECRYPT.txt Hive Ransomware.exe File opened for modification C:\Windows\SysWOW64\migration\WSMT\rras\dlmanifests\HOW_TO_DECRYPT.txt Hive Ransomware.exe -
resource yara_rule behavioral1/memory/2392-0-0x0000000001370000-0x00000000015D3000-memory.dmp upx behavioral1/memory/2392-13-0x0000000001370000-0x00000000015D3000-memory.dmp upx behavioral1/memory/2392-14-0x0000000001370000-0x00000000015D3000-memory.dmp upx behavioral1/memory/2392-2857-0x0000000001370000-0x00000000015D3000-memory.dmp upx behavioral1/memory/2392-6649-0x0000000001370000-0x00000000015D3000-memory.dmp upx behavioral1/memory/2392-10887-0x0000000001370000-0x00000000015D3000-memory.dmp upx behavioral1/memory/2392-11964-0x0000000001370000-0x00000000015D3000-memory.dmp upx behavioral1/memory/2392-14740-0x0000000001370000-0x00000000015D3000-memory.dmp upx behavioral1/memory/2392-15939-0x0000000001370000-0x00000000015D3000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_mpeg4audio_plugin.dll Hive Ransomware.exe File opened for modification C:\Program Files\Windows NT\TableTextService\TableTextServiceDaYi.txt Hive Ransomware.exe File opened for modification C:\Program Files (x86)\Common Files\System\ado\msado20.tlb Hive Ransomware.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\settings.html Hive Ransomware.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\SCDRESTL.ICO.5ITsMeTIfC-xFUkBHFILt0ikNpGq9hYTZvWG5w5Ow2w.hive Hive Ransomware.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-coredump.jar Hive Ransomware.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Edmonton Hive Ransomware.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\WB02073_.GIF.5ITsMeTIfC-xFUkBHFILty_IdXkeu_totYkBwKETLkM.hive Hive Ransomware.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.jdp_5.5.0.165303.jar Hive Ransomware.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.ext_5.5.0.165303.jar Hive Ransomware.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\UIAutomationTypes.resources.dll Hive Ransomware.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH00231_.WMF.5ITsMeTIfC-xFUkBHFILt0_7WBsWlI5xvuucWnqa1gw.hive Hive Ransomware.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.ds_1.4.200.v20131126-2331.jar.5ITsMeTIfC-xFUkBHFILt6rvyDSDm8g6nLVhId0qEzI.hive Hive Ransomware.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPTSFrame.png.5ITsMeTIfC-xFUkBHFILt0FswOxRQSF54OrTfAaS1RI.hive Hive Ransomware.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD10302_.GIF.5ITsMeTIfC-xFUkBHFILt121PxL6cpM87BsfdmHDGBI.hive Hive Ransomware.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\WPULQT98.POC.5ITsMeTIfC-xFUkBHFILt7t657JQ6QxwjLqM8hzez34.hive Hive Ransomware.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.greychart.ui_5.5.0.165303.jar Hive Ransomware.exe File opened for modification C:\Program Files\Windows Media Player\it-IT\wmlaunch.exe.mui Hive Ransomware.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0177257.JPG Hive Ransomware.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Earthy.css Hive Ransomware.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14582_.GIF.5ITsMeTIfC-xFUkBHFILt-w4WoQ_WcYb71PwgQxT4ns.hive Hive Ransomware.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\uarrow.gif Hive Ransomware.exe File created C:\Program Files\VideoLAN\VLC\locale\be\HOW_TO_DECRYPT.txt Hive Ransomware.exe File opened for modification C:\Program Files\Windows Media Player\en-US\wmpnetwk.exe.mui Hive Ransomware.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21534_.GIF.5ITsMeTIfC-xFUkBHFILt4yrelET7wE_to0Wmeg2n0U.hive Hive Ransomware.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.COM.MY.XML.5ITsMeTIfC-xFUkBHFILt7y1sueVMLh36IC9eJtXImU.hive Hive Ransomware.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\HOW_TO_DECRYPT.txt Hive Ransomware.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-io.xml Hive Ransomware.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_few-showers.png Hive Ransomware.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD00382_.WMF Hive Ransomware.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH01618_.WMF Hive Ransomware.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\excelcnv.exe Hive Ransomware.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0341534.JPG.5ITsMeTIfC-xFUkBHFILt4x8CDK1F9Z4QzjuZi6lKyg.hive Hive Ransomware.exe File opened for modification C:\Program Files\Java\jre7\lib\fonts\LucidaTypewriterBold.ttf.5ITsMeTIfC-xFUkBHFILt0GciuZtBrZsWt_VoQLwkSY.hive Hive Ransomware.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.renderers.swt_0.12.1.v20140903-1023.jar Hive Ransomware.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SONORA\THMBNAIL.PNG Hive Ransomware.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-charts.xml.5ITsMeTIfC-xFUkBHFILt-nT3bTLSJlVMzMDBXkm9FE.hive Hive Ransomware.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\zh_CN\LC_MESSAGES\vlc.mo.5ITsMeTIfC-xFUkBHFILt_WgUIVo39AVn6z8-4GBwCs.hive Hive Ransomware.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME48.CSS.5ITsMeTIfC-xFUkBHFILt-koox-DXwIsrOHdXzq8uXg.hive Hive Ransomware.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.widgets.nl_zh_4.4.0.v20140623020002.jar Hive Ransomware.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BL00012_.WMF Hive Ransomware.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD01015_.WMF Hive Ransomware.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGAD.DPV Hive Ransomware.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01298_.GIF.5ITsMeTIfC-xFUkBHFILtw7DssSeOHJ14V0A4Wnr1XQ.hive Hive Ransomware.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-utilities.jar Hive Ransomware.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\attach.dll.5ITsMeTIfC-xFUkBHFILt4ZyJ51jWKlh-COitwCA728.hive Hive Ransomware.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00452_.WMF Hive Ransomware.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\picturePuzzle.html Hive Ransomware.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.dll.5ITsMeTIfC-xFUkBHFILt-BUoxS5FpdzT7VyLxxNTiE.hive Hive Ransomware.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\it.pak Hive Ransomware.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.AddIn.Contract.dll Hive Ransomware.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ta.pak.5ITsMeTIfC-xFUkBHFILt_HORYJV_sFgJ11QCXqyuVw.hive Hive Ransomware.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0199483.WMF Hive Ransomware.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\menu_arrow.gif Hive Ransomware.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\STSLIST.DLL Hive Ransomware.exe File opened for modification C:\Program Files\Java\jre7\lib\management\snmp.acl.template.5ITsMeTIfC-xFUkBHFILtzxqYlZQIO48_8JdqWLI3Ww.hive Hive Ransomware.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\extcheck.exe Hive Ransomware.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Srednekolymsk Hive Ransomware.exe File opened for modification C:\Program Files (x86)\Common Files\System\msadc\fr-FR\msadcfr.dll.mui Hive Ransomware.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Swift_Current.5ITsMeTIfC-xFUkBHFILt-1aRp9w_0g_4s2N2c_9myQ.hive Hive Ransomware.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\PICCAP98.POC Hive Ransomware.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\css\picturePuzzle.css Hive Ransomware.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core-execution.xml.5ITsMeTIfC-xFUkBHFILt4pGhDrYND0-Kt_PoR4lr34.hive Hive Ransomware.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CGMIMP32.HLP.5ITsMeTIfC-xFUkBHFILt8WGD4QMc1BVqZyL8jKPGAs.hive Hive Ransomware.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SQL\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\inf\PNRPSvc\040C\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_it-it_6777afadccc8e29b\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.Framework\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\assembly\GAC_MSIL\System.IdentityModel.Selectors\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\System.Management.I#\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\winsxs\amd64_microsoft-windows-bootres_31bf3856ad364e35_6.1.7601.17514_none_9d42c69298905ee5\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Diagnostics.Tools\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\assembly\GAC_MSIL\System.Xml.Linq\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..utoenroll.resources_31bf3856ad364e35_6.1.7600.16385_it-it_a3d7481a3d71e712\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\Browsers\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\winsxs\amd64_microsoft-windows-b..os-loader.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_015df3e3bafadc7a\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\winsxs\amd64_microsoft-windows-cabview.resources_31bf3856ad364e35_6.1.7600.16385_de-de_94130886fdeb9eba\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\Boot\EFI\da-DK\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\assembly\GAC_MSIL\UIAutomationClient.resources\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\winsxs\amd64_microsoft-windows-dcom-adm_31bf3856ad364e35_6.1.7600.16385_none_15cecba78b4ebcad\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\winsxs\amd64_ds-ui-ext.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_1cadd67406e9cdc6\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\winsxs\amd64_iirsp2.inf.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_918cd071ea809e06\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\winsxs\amd64_microsoft-windows-c..atemanagersnapindll_31bf3856ad364e35_6.1.7601.17514_none_b3468cdac22c0118\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\System.Web.Entity\d3aaf07a1d6356d9edf7c3c9f4b7dd0d\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\winsxs\amd64_brmfport.inf.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_4908d7deeb296887\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\winsxs\amd64_microsoft-windows-a..gram-data.resources_31bf3856ad364e35_6.1.7600.16385_es-es_091207b89ca5f802\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_it_31bf3856ad364e35\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.GroupPoli#\1901ba5041844f16d62ecf639548c760\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\inf\wsearchidxpi\0411\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\winsxs\amd64_microsoft-windows-c..ltdel-adm.resources_31bf3856ad364e35_6.1.7600.16385_es-es_9b44757aefac2197\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\Boot\EFI\it-IT\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Providers\App_LocalResources\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\assembly\GAC_MSIL\System.Web.Routing.resources\3.5.0.0_ja_31bf3856ad364e35\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Wind74b7bf4b#\f3b97fc6e0780d13a9e007ff4051b68f\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\winsxs\amd64_desktop_shell-gettingstarted.resources_31bf3856ad364e35_6.1.7600.16385_es-es_9826e80ef3b15bbf\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\winsxs\amd64_image.inf.resources_31bf3856ad364e35_6.1.7600.16385_it-it_5e9f38101207409a\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\winsxs\amd64_microsoft-windows-b..ell-starter-edition_31bf3856ad364e35_6.1.7600.16385_none_4dbf51b90c943806\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\assembly\GAC_MSIL\System.Configuration.Install.resources\2.0.0.0_es_b03f5f7f11d50a3a\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\winsxs\amd64_microsoft-windows-b..dlinetool.resources_31bf3856ad364e35_6.1.7600.16385_de-de_d411df38a322dcc7\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..how-other.resources_31bf3856ad364e35_6.1.7600.16385_en-us_d7be6d634e78be97\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Xml.Serialization\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\assembly\GAC_MSIL\System.Workflow.ComponentModel\3.0.0.0__31bf3856ad364e35\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\winsxs\amd64_ddores.resources_31bf3856ad364e35_6.1.7600.16385_it-it_450bac9c54bfe095\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.B22c61a69#\4040994b0f6916a6cdecae442deb61d2\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Wind5abb17e9#\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\winsxs\amd64_microsoft-windows-dataclen.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_480cf801f40020fc\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Security\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\assembly\GAC_64\System.Data\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\assembly\GAC_MSIL\ReachFramework.resources\3.0.0.0_es_31bf3856ad364e35\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Work0493292f#\4832d6678c2546727da93ce691bd5066\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\diagnostics\scheduled\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\diagnostics\system\AERO\it-IT\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\inf\SMSvcHost 3.0.0.0\0411\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\winsxs\amd64_microsoft-windows-b..buggertransport-usb_31bf3856ad364e35_6.1.7600.16385_none_f9729b4224386e7a\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiUserXp\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Windows.ApplicationServer.Applications\v4.0_4.0.0.0__31bf3856ad364e35\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Threading.Overlapped\v4.0_4.0.0.0__b03f5f7f11d50a3a\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Data\8.0.0.0__b03f5f7f11d50a3a\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\winsxs\amd64_hid-user.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_f067c9d9c2297404\HOW_TO_DECRYPT.txt Hive Ransomware.exe File opened for modification C:\Windows\Installer\MSIE4A5.tmp msiexec.exe File created C:\Windows\assembly\GAC_MSIL\System.WorkflowServices.resources\3.5.0.0_de_31bf3856ad364e35\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\winsxs\amd64_digitalmediadevice.inf.resources_31bf3856ad364e35_6.1.7600.16385_en-us_ffd83a48de3b881c\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\assembly\GAC_32\System.Printing\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\Presentatiod51afaa5#\867cbe7462b04e2cf1ae39abb576ae2a\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression.ZipFile\HOW_TO_DECRYPT.txt Hive Ransomware.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..lient-adm.resources_31bf3856ad364e35_6.1.7600.16385_de-de_ea7b6ad3106c032c\HOW_TO_DECRYPT.txt Hive Ransomware.exe -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vssadmin.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EXCEL.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hive Ransomware.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe -
Delays execution with timeout.exe 64 IoCs
pid Process 2072 timeout.exe 2068 timeout.exe 1800 timeout.exe 2964 timeout.exe 552 timeout.exe 2880 timeout.exe 1816 timeout.exe 2416 timeout.exe 796 timeout.exe 2828 timeout.exe 2476 timeout.exe 2080 timeout.exe 2484 timeout.exe 2876 timeout.exe 1688 timeout.exe 2364 timeout.exe 2580 timeout.exe 984 timeout.exe 2736 timeout.exe 1472 timeout.exe 2912 timeout.exe 2688 timeout.exe 1536 timeout.exe 2748 timeout.exe 900 timeout.exe 2256 timeout.exe 2556 timeout.exe 1828 timeout.exe 1716 timeout.exe 2556 timeout.exe 2324 timeout.exe 108 timeout.exe 2156 timeout.exe 2948 timeout.exe 2748 timeout.exe 1396 timeout.exe 1816 timeout.exe 2092 timeout.exe 2412 timeout.exe 1580 timeout.exe 796 timeout.exe 1132 timeout.exe 2628 timeout.exe 1524 timeout.exe 2764 timeout.exe 2636 timeout.exe 832 timeout.exe 2020 timeout.exe 2548 timeout.exe 1188 timeout.exe 1284 timeout.exe 1252 timeout.exe 2168 timeout.exe 2856 timeout.exe 2976 timeout.exe 836 timeout.exe 2364 timeout.exe 1552 timeout.exe 2976 timeout.exe 2732 timeout.exe 1580 timeout.exe 1912 timeout.exe 2068 timeout.exe 1456 timeout.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Interacts with shadow copies 3 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 1456 vssadmin.exe -
Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D msiexec.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E msiexec.exe -
Modifies registry class 20 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\xmlfile\ShellEx\IconHandler msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\xmlfile\ShellEx msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\xmlfile\ShellEx\IconHandler msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\xmlfile\DefaultIcon msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\xmlfile\shell\open msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\xmlfile\shell\edit msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\xmlfile\shell\edit msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\xmlfile\shell\edit\command\ = "\"C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE\" /verb edit \"%1\"" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\xmlfile\DefaultIcon msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\xmlfile\ShellEx\IconHandler\ = "{AB968F1E-E20B-403A-9EB8-72EB0EB6797E}" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\xmlfile\shell\open\command msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\xmlfile\shell\edit\command msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\xmlfile\shell\open\command msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\xmlfile\shell\open msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\xmlfile\DefaultIcon\ = "\"%1\"" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\xmlfile msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\xmlfile\ShellEx\IconHandler msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\xmlfile\ShellEx msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\xmlfile\shell\edit\command msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\xmlfile\shell\open\command\ = "\"C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE\" /verb open \"%1\"" msiexec.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1976 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2392 Hive Ransomware.exe 1520 msiexec.exe 1520 msiexec.exe 1520 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeBackupPrivilege 2152 vssvc.exe Token: SeRestorePrivilege 2152 vssvc.exe Token: SeAuditPrivilege 2152 vssvc.exe Token: SeRestorePrivilege 1520 msiexec.exe Token: SeTakeOwnershipPrivilege 1520 msiexec.exe Token: SeSecurityPrivilege 1520 msiexec.exe Token: SeRestorePrivilege 1520 msiexec.exe Token: SeTakeOwnershipPrivilege 1520 msiexec.exe Token: SeRestorePrivilege 1520 msiexec.exe Token: SeTakeOwnershipPrivilege 1520 msiexec.exe Token: SeRestorePrivilege 1520 msiexec.exe Token: SeTakeOwnershipPrivilege 1520 msiexec.exe Token: SeRestorePrivilege 1520 msiexec.exe Token: SeTakeOwnershipPrivilege 1520 msiexec.exe Token: SeRestorePrivilege 1520 msiexec.exe Token: SeTakeOwnershipPrivilege 1520 msiexec.exe Token: SeRestorePrivilege 1520 msiexec.exe Token: SeTakeOwnershipPrivilege 1520 msiexec.exe Token: SeRestorePrivilege 1520 msiexec.exe Token: SeTakeOwnershipPrivilege 1520 msiexec.exe Token: SeRestorePrivilege 1520 msiexec.exe Token: SeTakeOwnershipPrivilege 1520 msiexec.exe Token: SeRestorePrivilege 1520 msiexec.exe Token: SeTakeOwnershipPrivilege 1520 msiexec.exe Token: SeRestorePrivilege 1520 msiexec.exe Token: SeTakeOwnershipPrivilege 1520 msiexec.exe Token: SeRestorePrivilege 1520 msiexec.exe Token: SeTakeOwnershipPrivilege 1520 msiexec.exe Token: SeRestorePrivilege 1520 msiexec.exe Token: SeTakeOwnershipPrivilege 1520 msiexec.exe Token: SeRestorePrivilege 1520 msiexec.exe Token: SeTakeOwnershipPrivilege 1520 msiexec.exe Token: SeRestorePrivilege 1520 msiexec.exe Token: SeTakeOwnershipPrivilege 1520 msiexec.exe Token: SeRestorePrivilege 1520 msiexec.exe Token: SeTakeOwnershipPrivilege 1520 msiexec.exe Token: SeRestorePrivilege 1520 msiexec.exe Token: SeTakeOwnershipPrivilege 1520 msiexec.exe Token: SeRestorePrivilege 1520 msiexec.exe Token: SeTakeOwnershipPrivilege 1520 msiexec.exe Token: SeRestorePrivilege 1520 msiexec.exe Token: SeTakeOwnershipPrivilege 1520 msiexec.exe Token: SeRestorePrivilege 1520 msiexec.exe Token: SeTakeOwnershipPrivilege 1520 msiexec.exe Token: SeRestorePrivilege 1520 msiexec.exe Token: SeTakeOwnershipPrivilege 1520 msiexec.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1976 EXCEL.EXE 1976 EXCEL.EXE 1976 EXCEL.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2392 wrote to memory of 2852 2392 Hive Ransomware.exe 31 PID 2392 wrote to memory of 2852 2392 Hive Ransomware.exe 31 PID 2392 wrote to memory of 2852 2392 Hive Ransomware.exe 31 PID 2392 wrote to memory of 2852 2392 Hive Ransomware.exe 31 PID 2392 wrote to memory of 940 2392 Hive Ransomware.exe 33 PID 2392 wrote to memory of 940 2392 Hive Ransomware.exe 33 PID 2392 wrote to memory of 940 2392 Hive Ransomware.exe 33 PID 2392 wrote to memory of 940 2392 Hive Ransomware.exe 33 PID 940 wrote to memory of 1456 940 cmd.exe 35 PID 940 wrote to memory of 1456 940 cmd.exe 35 PID 940 wrote to memory of 1456 940 cmd.exe 35 PID 940 wrote to memory of 1456 940 cmd.exe 35 PID 2852 wrote to memory of 2964 2852 cmd.exe 36 PID 2852 wrote to memory of 2964 2852 cmd.exe 36 PID 2852 wrote to memory of 2964 2852 cmd.exe 36 PID 2852 wrote to memory of 2964 2852 cmd.exe 36 PID 2852 wrote to memory of 2476 2852 cmd.exe 38 PID 2852 wrote to memory of 2476 2852 cmd.exe 38 PID 2852 wrote to memory of 2476 2852 cmd.exe 38 PID 2852 wrote to memory of 2476 2852 cmd.exe 38 PID 2852 wrote to memory of 832 2852 cmd.exe 39 PID 2852 wrote to memory of 832 2852 cmd.exe 39 PID 2852 wrote to memory of 832 2852 cmd.exe 39 PID 2852 wrote to memory of 832 2852 cmd.exe 39 PID 2852 wrote to memory of 1456 2852 cmd.exe 40 PID 2852 wrote to memory of 1456 2852 cmd.exe 40 PID 2852 wrote to memory of 1456 2852 cmd.exe 40 PID 2852 wrote to memory of 1456 2852 cmd.exe 40 PID 2852 wrote to memory of 2020 2852 cmd.exe 41 PID 2852 wrote to memory of 2020 2852 cmd.exe 41 PID 2852 wrote to memory of 2020 2852 cmd.exe 41 PID 2852 wrote to memory of 2020 2852 cmd.exe 41 PID 2852 wrote to memory of 2072 2852 cmd.exe 42 PID 2852 wrote to memory of 2072 2852 cmd.exe 42 PID 2852 wrote to memory of 2072 2852 cmd.exe 42 PID 2852 wrote to memory of 2072 2852 cmd.exe 42 PID 2852 wrote to memory of 2168 2852 cmd.exe 43 PID 2852 wrote to memory of 2168 2852 cmd.exe 43 PID 2852 wrote to memory of 2168 2852 cmd.exe 43 PID 2852 wrote to memory of 2168 2852 cmd.exe 43 PID 2852 wrote to memory of 796 2852 cmd.exe 45 PID 2852 wrote to memory of 796 2852 cmd.exe 45 PID 2852 wrote to memory of 796 2852 cmd.exe 45 PID 2852 wrote to memory of 796 2852 cmd.exe 45 PID 2852 wrote to memory of 2912 2852 cmd.exe 46 PID 2852 wrote to memory of 2912 2852 cmd.exe 46 PID 2852 wrote to memory of 2912 2852 cmd.exe 46 PID 2852 wrote to memory of 2912 2852 cmd.exe 46 PID 2852 wrote to memory of 2068 2852 cmd.exe 47 PID 2852 wrote to memory of 2068 2852 cmd.exe 47 PID 2852 wrote to memory of 2068 2852 cmd.exe 47 PID 2852 wrote to memory of 2068 2852 cmd.exe 47 PID 2852 wrote to memory of 108 2852 cmd.exe 48 PID 2852 wrote to memory of 108 2852 cmd.exe 48 PID 2852 wrote to memory of 108 2852 cmd.exe 48 PID 2852 wrote to memory of 108 2852 cmd.exe 48 PID 2852 wrote to memory of 2628 2852 cmd.exe 51 PID 2852 wrote to memory of 2628 2852 cmd.exe 51 PID 2852 wrote to memory of 2628 2852 cmd.exe 51 PID 2852 wrote to memory of 2628 2852 cmd.exe 51 PID 1520 wrote to memory of 2536 1520 msiexec.exe 52 PID 1520 wrote to memory of 2536 1520 msiexec.exe 52 PID 1520 wrote to memory of 2536 1520 msiexec.exe 52 PID 1520 wrote to memory of 2536 1520 msiexec.exe 52 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Hive Ransomware.exe"C:\Users\Admin\AppData\Local\Temp\Hive Ransomware.exe"1⤵
- Drops file in Drivers directory
- Drops startup file
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Windows\SysWOW64\cmd.execmd /c hive.bat >NUL 2>NUL2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2964
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:2476
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:832
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:1456
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2020
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2072
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2168
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:796
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2912
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2068
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:108
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2628
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2556
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:1688
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2976
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2080
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:1816
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2364
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2732
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2156
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2856
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2416
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:796
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2548
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2948
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:1828
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:1524
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2976
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2688
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2764
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:836
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2748
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2364
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:1800
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:1132
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:1536
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:1188
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:1396
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:1580
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2412
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:1816
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:552
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:984
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2828
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2736
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:900
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2256
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:1716
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:1472
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1252
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2556
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2484
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2636
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2880
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2876
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2580
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1580
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2748
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2324
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2068
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:1912
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1552
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:2092
-
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1284
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c shadow.bat >NUL 2>NUL2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:940 -
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe delete shadows /all /quiet3⤵
- System Location Discovery: System Language Discovery
- Interacts with shadow copies
PID:1456
-
-
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1976
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2152
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding C7C0E956F142523F516C32E0DCBA4DEC2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2536
-
-
C:\Windows\system32\MsiExec.exeC:\Windows\system32\MsiExec.exe -Embedding 15D7311786F41BC0D0D0A11CA4DC46D02⤵
- Loads dropped DLL
PID:1336
-
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD5a526b9e7c716b3489d8cc062fbce4005
SHA12df502a944ff721241be20a9e449d2acd07e0312
SHA256e1b9ce9b57957b1a0607a72a057d6b7a9b34ea60f3f8aa8f38a3af979bd23066
SHA512d83d4c656c96c3d1809ad06ce78fa09a77781461c99109e4b81d1a186fc533a7e72d65a4cb7edf689eeccda8f687a13d3276f1111a1e72f7c3cd92a49bce0f88
-
Filesize
1KB
MD580207d0f8ea42bdfeaf9f5c586230aca
SHA1747481fe2b0b6d81c3b19ba62d1e49eab6a5461f
SHA25625edefb3b0678dfe0d927ff48ce67254359ba379df9468f634d02c026f0e7131
SHA51273f68ce9e98d2346be1762bd54bb06ef83ae939dfbcf9b786d9b773fa454352613387d264b7a87a1c08950226553817bf01f5aa4107bc12de36a1689e2137304
-
Filesize
184B
MD5dc70612dee31a62e834e95709feaa5f7
SHA1e3bbac5149ec5f27af0743d4fd332622920d518d
SHA25607dc3fa1e68246d5a57206cf5ae3598a00049a80339bcd89db12fb1b10ba785c
SHA5124a43ffae88b8026d272626aecb091a4177dec2ffc9f83999dc62499a2ecf80849580e32ddcbb40a57acca90e9dce1a9ab5712544fea96d4f68821c7bc39e1162
-
Filesize
57B
MD5df5552357692e0cba5e69f8fbf06abb6
SHA14714f1e6bb75a80a8faf69434726d176b70d7bd8
SHA256d158f9d53e7c37eadd3b5cc1b82d095f61484e47eda2c36d9d35f31c0b4d3ff8
SHA512a837555a1175ab515e2b43da9e493ff0ccd4366ee59defe6770327818ca9afa6f3e39ecdf5262b69253aa9e2692283ee8cebc97d58edd42e676977c7f73d143d
-
Filesize
415B
MD5407e6c24f32937b452bbe57b16ab5772
SHA1b0a2d5d51346a66a33f8711dfe179080c3b2900a
SHA2566ca0b8a423b75c9303cda28dbe36b755515b10cb81ac5037c4e03caf3bc83503
SHA512bfdcc89c647e5d7f88d6376d8d5e67fd55ea08f8dccf5809cb3e49d2de39a2f36db7394381a389395eb3266bc8d6f6ba35d1ddde4b934e1ff91f114669105812
-
Filesize
257KB
MD5d1f5ce6b23351677e54a245f46a9f8d2
SHA10d5c6749401248284767f16df92b726e727718ca
SHA25657cb8f01cf553c3886760180d1a74839f2f676640115504485aca9692f577acc
SHA512960e90894e7bedcc89894e77e57e8ee0c99dd2c530d02665e8bbd3a1793eccc1e295c5923d1f37c757fa1158097fbaae70898c16052882d3d210c29ea801b3ba
-
Filesize
28KB
MD585221b3bcba8dbe4b4a46581aa49f760
SHA1746645c92594bfc739f77812d67cfd85f4b92474
SHA256f6e34a4550e499346f5ab1d245508f16bf765ff24c4988984b89e049ca55737f
SHA512060e35c4de14a03a2cda313f968e372291866cc4acd59977d7a48ac3745494abc54df83fff63cf30be4e10ff69a3b3c8b6c38f43ebd2a8d23d6c86fbee7ba87d
-
Filesize
86KB
MD5ff58cd07bf4913ef899efd2dfb112553
SHA1f14c1681de808543071602f17a6299f8b4ba2ae8
SHA2561afafe9157ff5670bbec8ce622f45d1ce51b3ee77b7348d3a237e232f06c5391
SHA51223e27444b6cdc17fe56f3a80d6325c2be61ae84213bc7cdaad7bb96daa7e8d2d3defc1b96c3cee4a3f32dc464b0e05720bcf1c0e99626bf83de1b6d5aac000a3
-
Filesize
47KB
MD581e7e920312d372cf57a817049ac7c76
SHA10a2e953f2d8ecdf984532f2d8e3c0264fc079498
SHA256ff9a2e7fe46937b34f8e61f58df1f6108742cce58505f212e8666cb4ab7b74f9
SHA51276530f002a84a791f1b440c1ab57138b8813dc395027e5c02002d67e9c7a72d6e448bbc2f844fd2cfb61259c37d916a6835035bdb442b45814c1d1aab4743a52
-
Filesize
953KB
MD52f4759c23abcd639ac3ca7f8fa9480ac
SHA19a3fece585fa01b7b941e124ead0c39c8ce9bc7c
SHA2566d66fa59407862e0fddfcb36472fe810eb308653321ca0e374ac870f9aa8cec6
SHA5126ab14d6a8d3e9a751d68133e734cc804de2b50a7ef223d484d0f727cdfbd00d48f6e0666c3b86a0daf9ca42c0b726f6c2a088e5bb32c993748abfea7b5904ec6
-
Filesize
363KB
MD54a843a97ae51c310b573a02ffd2a0e8e
SHA1063fa914ccb07249123c0d5f4595935487635b20
SHA256727ecf287fb6f4953ee7748913dd559b4f8d3a022fa2ca55bc51cf5886c52086
SHA512905c081552d95b523ecf1155b6c7e157652e5ff00cda30c1c21124d266eb7d305c3398d6832316f403dc45d1b639f1a5a67aea29922cd1a032f52e5247ec55d2
-
Filesize
148KB
MD533908aa43ac0aaabc06a58d51b1c2cca
SHA10a0d1ce3435abe2eed635481bac69e1999031291
SHA2564447faacefaba8f040822101e2a4103031660de9139e70ecff9aa3a89455a783
SHA512d5216a53df9cfbe1a78629c103286eb17042f639149c46b6a1cd76498531ae82afd265462fbe0ba9baaff275fc95c66504804f107c449f3fc5833b1ed9c3da46