Overview

overview

10

Static

static

5

HiveRansomware.exe

windows7-x64

10

HiveRansomware.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    134s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250217-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/03/2025, 10:30

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    HiveRansomware.exe

  • Size

    764KB

  • MD5

    2f9fc82898d718f2abe99c4a6fa79e69

  • SHA1

    9d336b8911c8ffd7cc809e31d5b53796bb0cc7bb

  • SHA256

    88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1

  • SHA512

    19f0879b1c54d305ab7a97a0d46ab79c103d4687fe37d5f9ef1934904eea48a1c66b1ac2de3dace6dc0d91623309287044c198cb0b3fc9f8453fbc9d1c0cae8b

  • SSDEEP

    12288:CinNFNkY/yU97ppM4NSBG81Np2C9H4S3iDjlLtc4wCIITIQaOI6NrwacVYV+4MsT:CinN3n/y67jM4v4kCSPDjlLtbwt8IQLH

Score
10/10
hivecredential_accessdiscoverypersistenceransomwarespywarestealerupx

Malware Config

Extracted

Path

C:\$Recycle.Bin\HOW_TO_DECRYPT.txt

Family

hive

Ransom Note
Your network has been breached and all data is encrypted. To decrypt all the data you will need to purchase our decryption software. Please contact our sales department at: http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/ Login: EQA9oydTxwXS Password: vNtgAgb3kMFmCooANNQr Follow the guidelines below to avoid losing your data: - Do not shutdown or reboot your computers, unmount external storages. - Do not try to decrypt data using third party software. It may cause irreversible damage. - Do not fool yourself. Encryption has perfect secrecy and it's impossible to decrypt without knowing the key. - Do not modify, rename or delete *.key.hive files. Your data will be undecryptable. - Do not modify or rename encrypted files. You will lose them. - Do not report to authorities. The negotiation process will be terminated immediately and the key will be erased. - Do not reject to purchase. Your sensitive data will be publicly disclosed at http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/
URLs

http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/

http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/

Signatures

  • Detects Go variant of Hive Ransomware 15 IoCs
  • Hive

    A ransomware written in Golang first seen in June 2021.

    ransomwarehive
  • Hive family
    hive
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Drops file in Drivers directory 20 IoCs
  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Drops startup file 4 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 64 IoCs
  • Drops file in System32 directory 64 IoCs
  • UPX packed file 16 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Delays execution with timeout.exe 64 IoCs
    defense_evasion
  • Modifies registry class 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\HiveRansomware.exe
    "C:\Users\Admin\AppData\Local\Temp\HiveRansomware.exe"
    1⤵
    • Drops file in Drivers directory
    • Drops startup file
    • Drops desktop.ini file(s)
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3760
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c hive.bat >NUL 2>NUL
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5044
      • C:\Windows\SysWOW64\timeout.exe
        timeout 1
        3⤵
          PID:644
        • C:\Windows\SysWOW64\timeout.exe
          timeout 1
          3⤵
          • System Location Discovery: System Language Discovery
          PID:4244
        • C:\Windows\SysWOW64\timeout.exe
          timeout 1
          3⤵
          • System Location Discovery: System Language Discovery
          • Delays execution with timeout.exe
          PID:2380
        • C:\Windows\SysWOW64\timeout.exe
          timeout 1
          3⤵
          • System Location Discovery: System Language Discovery
          • Delays execution with timeout.exe
          PID:3956
        • C:\Windows\SysWOW64\timeout.exe
          timeout 1
          3⤵
          • System Location Discovery: System Language Discovery
          • Delays execution with timeout.exe
          PID:4180
        • C:\Windows\SysWOW64\timeout.exe
          timeout 1
          3⤵
          • System Location Discovery: System Language Discovery
          • Delays execution with timeout.exe
          PID:4520
        • C:\Windows\SysWOW64\timeout.exe
          timeout 1
          3⤵
            PID:5064
          • C:\Windows\SysWOW64\timeout.exe
            timeout 1
            3⤵
            • System Location Discovery: System Language Discovery
            • Delays execution with timeout.exe
            PID:1960
          • C:\Windows\SysWOW64\timeout.exe
            timeout 1
            3⤵
            • Delays execution with timeout.exe
            PID:4352
          • C:\Windows\SysWOW64\timeout.exe
            timeout 1
            3⤵
            • System Location Discovery: System Language Discovery
            PID:3908
          • C:\Windows\SysWOW64\timeout.exe
            timeout 1
            3⤵
            • System Location Discovery: System Language Discovery
            PID:888
          • C:\Windows\SysWOW64\timeout.exe
            timeout 1
            3⤵
            • Delays execution with timeout.exe
            PID:3268
          • C:\Windows\SysWOW64\timeout.exe
            timeout 1
            3⤵
            • System Location Discovery: System Language Discovery
            PID:2280
          • C:\Windows\SysWOW64\timeout.exe
            timeout 1
            3⤵
            • System Location Discovery: System Language Discovery
            PID:4380
          • C:\Windows\SysWOW64\timeout.exe
            timeout 1
            3⤵
            • System Location Discovery: System Language Discovery
            • Delays execution with timeout.exe
            PID:3352
          • C:\Windows\SysWOW64\timeout.exe
            timeout 1
            3⤵
            • System Location Discovery: System Language Discovery
            PID:2228
          • C:\Windows\SysWOW64\timeout.exe
            timeout 1
            3⤵
            • Delays execution with timeout.exe
            PID:2388
          • C:\Windows\SysWOW64\timeout.exe
            timeout 1
            3⤵
            • Delays execution with timeout.exe
            PID:4580
          • C:\Windows\SysWOW64\timeout.exe
            timeout 1
            3⤵
            • System Location Discovery: System Language Discovery
            • Delays execution with timeout.exe
            PID:1996
          • C:\Windows\SysWOW64\timeout.exe
            timeout 1
            3⤵
            • System Location Discovery: System Language Discovery
            PID:4404
          • C:\Windows\SysWOW64\timeout.exe
            timeout 1
            3⤵
              PID:1444
            • C:\Windows\SysWOW64\timeout.exe
              timeout 1
              3⤵
              • Delays execution with timeout.exe
              PID:3864
            • C:\Windows\SysWOW64\timeout.exe
              timeout 1
              3⤵
              • System Location Discovery: System Language Discovery
              PID:788
            • C:\Windows\SysWOW64\timeout.exe
              timeout 1
              3⤵
                PID:3232
              • C:\Windows\SysWOW64\timeout.exe
                timeout 1
                3⤵
                  PID:4180
                • C:\Windows\SysWOW64\timeout.exe
                  timeout 1
                  3⤵
                    PID:4732
                  • C:\Windows\SysWOW64\timeout.exe
                    timeout 1
                    3⤵
                    • Delays execution with timeout.exe
                    PID:1604
                  • C:\Windows\SysWOW64\timeout.exe
                    timeout 1
                    3⤵
                    • System Location Discovery: System Language Discovery
                    • Delays execution with timeout.exe
                    PID:2912
                  • C:\Windows\SysWOW64\timeout.exe
                    timeout 1
                    3⤵
                      PID:1008
                    • C:\Windows\SysWOW64\timeout.exe
                      timeout 1
                      3⤵
                      • System Location Discovery: System Language Discovery
                      PID:3184
                    • C:\Windows\SysWOW64\timeout.exe
                      timeout 1
                      3⤵
                      • Delays execution with timeout.exe
                      PID:384
                    • C:\Windows\SysWOW64\timeout.exe
                      timeout 1
                      3⤵
                      • System Location Discovery: System Language Discovery
                      • Delays execution with timeout.exe
                      PID:2348
                    • C:\Windows\SysWOW64\timeout.exe
                      timeout 1
                      3⤵
                      • System Location Discovery: System Language Discovery
                      • Delays execution with timeout.exe
                      PID:4392
                    • C:\Windows\SysWOW64\timeout.exe
                      timeout 1
                      3⤵
                        PID:5096
                      • C:\Windows\SysWOW64\timeout.exe
                        timeout 1
                        3⤵
                        • System Location Discovery: System Language Discovery
                        • Delays execution with timeout.exe
                        PID:4716
                      • C:\Windows\SysWOW64\timeout.exe
                        timeout 1
                        3⤵
                        • System Location Discovery: System Language Discovery
                        PID:3500
                      • C:\Windows\SysWOW64\timeout.exe
                        timeout 1
                        3⤵
                        • Delays execution with timeout.exe
                        PID:844
                      • C:\Windows\SysWOW64\timeout.exe
                        timeout 1
                        3⤵
                          PID:4444
                        • C:\Windows\SysWOW64\timeout.exe
                          timeout 1
                          3⤵
                          • System Location Discovery: System Language Discovery
                          PID:2940
                        • C:\Windows\SysWOW64\timeout.exe
                          timeout 1
                          3⤵
                          • Delays execution with timeout.exe
                          PID:5104
                        • C:\Windows\SysWOW64\timeout.exe
                          timeout 1
                          3⤵
                          • System Location Discovery: System Language Discovery
                          PID:1552
                        • C:\Windows\SysWOW64\timeout.exe
                          timeout 1
                          3⤵
                          • System Location Discovery: System Language Discovery
                          • Delays execution with timeout.exe
                          PID:4716
                        • C:\Windows\SysWOW64\timeout.exe
                          timeout 1
                          3⤵
                          • Delays execution with timeout.exe
                          PID:2104
                        • C:\Windows\SysWOW64\timeout.exe
                          timeout 1
                          3⤵
                          • Delays execution with timeout.exe
                          PID:4316
                        • C:\Windows\SysWOW64\timeout.exe
                          timeout 1
                          3⤵
                          • Delays execution with timeout.exe
                          PID:4076
                        • C:\Windows\SysWOW64\timeout.exe
                          timeout 1
                          3⤵
                          • System Location Discovery: System Language Discovery
                          • Delays execution with timeout.exe
                          PID:5068
                        • C:\Windows\SysWOW64\timeout.exe
                          timeout 1
                          3⤵
                          • System Location Discovery: System Language Discovery
                          • Delays execution with timeout.exe
                          PID:3360
                        • C:\Windows\SysWOW64\timeout.exe
                          timeout 1
                          3⤵
                          • System Location Discovery: System Language Discovery
                          • Delays execution with timeout.exe
                          PID:4392
                        • C:\Windows\SysWOW64\timeout.exe
                          timeout 1
                          3⤵
                          • Delays execution with timeout.exe
                          PID:4972
                        • C:\Windows\SysWOW64\timeout.exe
                          timeout 1
                          3⤵
                            PID:4756
                          • C:\Windows\SysWOW64\timeout.exe
                            timeout 1
                            3⤵
                              PID:1856
                            • C:\Windows\SysWOW64\timeout.exe
                              timeout 1
                              3⤵
                              • Delays execution with timeout.exe
                              PID:2600
                            • C:\Windows\SysWOW64\timeout.exe
                              timeout 1
                              3⤵
                              • Delays execution with timeout.exe
                              PID:4468
                            • C:\Windows\SysWOW64\timeout.exe
                              timeout 1
                              3⤵
                                PID:3912
                              • C:\Windows\SysWOW64\timeout.exe
                                timeout 1
                                3⤵
                                • System Location Discovery: System Language Discovery
                                PID:2664
                              • C:\Windows\SysWOW64\timeout.exe
                                timeout 1
                                3⤵
                                  PID:4732
                                • C:\Windows\SysWOW64\timeout.exe
                                  timeout 1
                                  3⤵
                                  • System Location Discovery: System Language Discovery
                                  • Delays execution with timeout.exe
                                  PID:1756
                                • C:\Windows\SysWOW64\timeout.exe
                                  timeout 1
                                  3⤵
                                  • System Location Discovery: System Language Discovery
                                  • Delays execution with timeout.exe
                                  PID:4540
                                • C:\Windows\SysWOW64\timeout.exe
                                  timeout 1
                                  3⤵
                                  • Delays execution with timeout.exe
                                  PID:2120
                                • C:\Windows\SysWOW64\timeout.exe
                                  timeout 1
                                  3⤵
                                    PID:4072
                                  • C:\Windows\SysWOW64\timeout.exe
                                    timeout 1
                                    3⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:1376
                                  • C:\Windows\SysWOW64\timeout.exe
                                    timeout 1
                                    3⤵
                                    • System Location Discovery: System Language Discovery
                                    • Delays execution with timeout.exe
                                    PID:4048
                                  • C:\Windows\SysWOW64\timeout.exe
                                    timeout 1
                                    3⤵
                                    • Delays execution with timeout.exe
                                    PID:4404
                                  • C:\Windows\SysWOW64\timeout.exe
                                    timeout 1
                                    3⤵
                                      PID:4628
                                    • C:\Windows\SysWOW64\timeout.exe
                                      timeout 1
                                      3⤵
                                        PID:3944
                                      • C:\Windows\SysWOW64\timeout.exe
                                        timeout 1
                                        3⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:1268
                                      • C:\Windows\SysWOW64\timeout.exe
                                        timeout 1
                                        3⤵
                                        • Delays execution with timeout.exe
                                        PID:4272
                                      • C:\Windows\SysWOW64\timeout.exe
                                        timeout 1
                                        3⤵
                                        • System Location Discovery: System Language Discovery
                                        • Delays execution with timeout.exe
                                        PID:3532
                                      • C:\Windows\SysWOW64\timeout.exe
                                        timeout 1
                                        3⤵
                                          PID:392
                                        • C:\Windows\SysWOW64\timeout.exe
                                          timeout 1
                                          3⤵
                                            PID:2644
                                          • C:\Windows\SysWOW64\timeout.exe
                                            timeout 1
                                            3⤵
                                            • System Location Discovery: System Language Discovery
                                            PID:1752
                                          • C:\Windows\SysWOW64\timeout.exe
                                            timeout 1
                                            3⤵
                                            • System Location Discovery: System Language Discovery
                                            • Delays execution with timeout.exe
                                            PID:1944
                                          • C:\Windows\SysWOW64\timeout.exe
                                            timeout 1
                                            3⤵
                                              PID:4520
                                            • C:\Windows\SysWOW64\timeout.exe
                                              timeout 1
                                              3⤵
                                              • Delays execution with timeout.exe
                                              PID:5068
                                            • C:\Windows\SysWOW64\timeout.exe
                                              timeout 1
                                              3⤵
                                              • System Location Discovery: System Language Discovery
                                              • Delays execution with timeout.exe
                                              PID:3964
                                            • C:\Windows\SysWOW64\timeout.exe
                                              timeout 1
                                              3⤵
                                                PID:4480
                                              • C:\Windows\SysWOW64\timeout.exe
                                                timeout 1
                                                3⤵
                                                • System Location Discovery: System Language Discovery
                                                • Delays execution with timeout.exe
                                                PID:4352
                                              • C:\Windows\SysWOW64\timeout.exe
                                                timeout 1
                                                3⤵
                                                  PID:4708
                                                • C:\Windows\SysWOW64\timeout.exe
                                                  timeout 1
                                                  3⤵
                                                  • System Location Discovery: System Language Discovery
                                                  PID:1320
                                                • C:\Windows\SysWOW64\timeout.exe
                                                  timeout 1
                                                  3⤵
                                                  • Delays execution with timeout.exe
                                                  PID:4436
                                                • C:\Windows\SysWOW64\timeout.exe
                                                  timeout 1
                                                  3⤵
                                                    PID:2580
                                                  • C:\Windows\SysWOW64\timeout.exe
                                                    timeout 1
                                                    3⤵
                                                    • Delays execution with timeout.exe
                                                    PID:2884
                                                  • C:\Windows\SysWOW64\timeout.exe
                                                    timeout 1
                                                    3⤵
                                                      PID:4248
                                                    • C:\Windows\SysWOW64\timeout.exe
                                                      timeout 1
                                                      3⤵
                                                        PID:1916
                                                      • C:\Windows\SysWOW64\timeout.exe
                                                        timeout 1
                                                        3⤵
                                                          PID:4312
                                                        • C:\Windows\SysWOW64\timeout.exe
                                                          timeout 1
                                                          3⤵
                                                          • System Location Discovery: System Language Discovery
                                                          • Delays execution with timeout.exe
                                                          PID:4432
                                                        • C:\Windows\SysWOW64\timeout.exe
                                                          timeout 1
                                                          3⤵
                                                          • System Location Discovery: System Language Discovery
                                                          PID:1840
                                                        • C:\Windows\SysWOW64\timeout.exe
                                                          timeout 1
                                                          3⤵
                                                          • System Location Discovery: System Language Discovery
                                                          • Delays execution with timeout.exe
                                                          PID:4932
                                                        • C:\Windows\SysWOW64\timeout.exe
                                                          timeout 1
                                                          3⤵
                                                            PID:4188
                                                          • C:\Windows\SysWOW64\timeout.exe
                                                            timeout 1
                                                            3⤵
                                                              PID:4176
                                                            • C:\Windows\SysWOW64\timeout.exe
                                                              timeout 1
                                                              3⤵
                                                              • System Location Discovery: System Language Discovery
                                                              • Delays execution with timeout.exe
                                                              PID:5064
                                                            • C:\Windows\SysWOW64\timeout.exe
                                                              timeout 1
                                                              3⤵
                                                                PID:3124
                                                              • C:\Windows\SysWOW64\timeout.exe
                                                                timeout 1
                                                                3⤵
                                                                  PID:2060
                                                                • C:\Windows\SysWOW64\timeout.exe
                                                                  timeout 1
                                                                  3⤵
                                                                  • System Location Discovery: System Language Discovery
                                                                  PID:4264
                                                                • C:\Windows\SysWOW64\timeout.exe
                                                                  timeout 1
                                                                  3⤵
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Delays execution with timeout.exe
                                                                  PID:4296
                                                                • C:\Windows\SysWOW64\timeout.exe
                                                                  timeout 1
                                                                  3⤵
                                                                  • System Location Discovery: System Language Discovery
                                                                  PID:4308
                                                                • C:\Windows\SysWOW64\timeout.exe
                                                                  timeout 1
                                                                  3⤵
                                                                    PID:1640
                                                                  • C:\Windows\SysWOW64\timeout.exe
                                                                    timeout 1
                                                                    3⤵
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:8
                                                                  • C:\Windows\SysWOW64\timeout.exe
                                                                    timeout 1
                                                                    3⤵
                                                                      PID:2644
                                                                    • C:\Windows\SysWOW64\timeout.exe
                                                                      timeout 1
                                                                      3⤵
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:3880
                                                                    • C:\Windows\SysWOW64\timeout.exe
                                                                      timeout 1
                                                                      3⤵
                                                                      • Delays execution with timeout.exe
                                                                      PID:3576
                                                                    • C:\Windows\SysWOW64\timeout.exe
                                                                      timeout 1
                                                                      3⤵
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:4540
                                                                    • C:\Windows\SysWOW64\timeout.exe
                                                                      timeout 1
                                                                      3⤵
                                                                        PID:696
                                                                      • C:\Windows\SysWOW64\timeout.exe
                                                                        timeout 1
                                                                        3⤵
                                                                          PID:4600
                                                                        • C:\Windows\SysWOW64\timeout.exe
                                                                          timeout 1
                                                                          3⤵
                                                                          • System Location Discovery: System Language Discovery
                                                                          • Delays execution with timeout.exe
                                                                          PID:1312
                                                                        • C:\Windows\SysWOW64\timeout.exe
                                                                          timeout 1
                                                                          3⤵
                                                                          • System Location Discovery: System Language Discovery
                                                                          PID:4068
                                                                        • C:\Windows\SysWOW64\timeout.exe
                                                                          timeout 1
                                                                          3⤵
                                                                          • System Location Discovery: System Language Discovery
                                                                          PID:5104
                                                                        • C:\Windows\SysWOW64\timeout.exe
                                                                          timeout 1
                                                                          3⤵
                                                                          • System Location Discovery: System Language Discovery
                                                                          • Delays execution with timeout.exe
                                                                          PID:1808
                                                                        • C:\Windows\SysWOW64\timeout.exe
                                                                          timeout 1
                                                                          3⤵
                                                                          • System Location Discovery: System Language Discovery
                                                                          • Delays execution with timeout.exe
                                                                          PID:2440
                                                                        • C:\Windows\SysWOW64\timeout.exe
                                                                          timeout 1
                                                                          3⤵
                                                                            PID:4404
                                                                          • C:\Windows\SysWOW64\timeout.exe
                                                                            timeout 1
                                                                            3⤵
                                                                              PID:4128
                                                                            • C:\Windows\SysWOW64\timeout.exe
                                                                              timeout 1
                                                                              3⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              • Delays execution with timeout.exe
                                                                              PID:412
                                                                            • C:\Windows\SysWOW64\timeout.exe
                                                                              timeout 1
                                                                              3⤵
                                                                              • Delays execution with timeout.exe
                                                                              PID:4244
                                                                            • C:\Windows\SysWOW64\timeout.exe
                                                                              timeout 1
                                                                              3⤵
                                                                                PID:4408
                                                                              • C:\Windows\SysWOW64\timeout.exe
                                                                                timeout 1
                                                                                3⤵
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:1320
                                                                              • C:\Windows\SysWOW64\timeout.exe
                                                                                timeout 1
                                                                                3⤵
                                                                                  PID:1476
                                                                                • C:\Windows\SysWOW64\timeout.exe
                                                                                  timeout 1
                                                                                  3⤵
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  PID:3980
                                                                                • C:\Windows\SysWOW64\timeout.exe
                                                                                  timeout 1
                                                                                  3⤵
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  PID:3732
                                                                                • C:\Windows\SysWOW64\timeout.exe
                                                                                  timeout 1
                                                                                  3⤵
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  • Delays execution with timeout.exe
                                                                                  PID:3756
                                                                                • C:\Windows\SysWOW64\timeout.exe
                                                                                  timeout 1
                                                                                  3⤵
                                                                                  • Delays execution with timeout.exe
                                                                                  PID:164
                                                                                • C:\Windows\SysWOW64\timeout.exe
                                                                                  timeout 1
                                                                                  3⤵
                                                                                  • Delays execution with timeout.exe
                                                                                  PID:5092
                                                                                • C:\Windows\SysWOW64\timeout.exe
                                                                                  timeout 1
                                                                                  3⤵
                                                                                  • Delays execution with timeout.exe
                                                                                  PID:1916
                                                                                • C:\Windows\SysWOW64\timeout.exe
                                                                                  timeout 1
                                                                                  3⤵
                                                                                    PID:672
                                                                                  • C:\Windows\SysWOW64\timeout.exe
                                                                                    timeout 1
                                                                                    3⤵
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    PID:668
                                                                                  • C:\Windows\SysWOW64\timeout.exe
                                                                                    timeout 1
                                                                                    3⤵
                                                                                      PID:3924
                                                                                    • C:\Windows\SysWOW64\timeout.exe
                                                                                      timeout 1
                                                                                      3⤵
                                                                                      • Delays execution with timeout.exe
                                                                                      PID:4136
                                                                                    • C:\Windows\SysWOW64\timeout.exe
                                                                                      timeout 1
                                                                                      3⤵
                                                                                        PID:5084
                                                                                      • C:\Windows\SysWOW64\timeout.exe
                                                                                        timeout 1
                                                                                        3⤵
                                                                                          PID:856
                                                                                        • C:\Windows\SysWOW64\timeout.exe
                                                                                          timeout 1
                                                                                          3⤵
                                                                                          • Delays execution with timeout.exe
                                                                                          PID:4384
                                                                                        • C:\Windows\SysWOW64\timeout.exe
                                                                                          timeout 1
                                                                                          3⤵
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          • Delays execution with timeout.exe
                                                                                          PID:3028
                                                                                        • C:\Windows\SysWOW64\timeout.exe
                                                                                          timeout 1
                                                                                          3⤵
                                                                                          • Delays execution with timeout.exe
                                                                                          PID:1856
                                                                                        • C:\Windows\SysWOW64\timeout.exe
                                                                                          timeout 1
                                                                                          3⤵
                                                                                            PID:4980
                                                                                          • C:\Windows\SysWOW64\timeout.exe
                                                                                            timeout 1
                                                                                            3⤵
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            PID:4724
                                                                                          • C:\Windows\SysWOW64\timeout.exe
                                                                                            timeout 1
                                                                                            3⤵
                                                                                              PID:4000
                                                                                            • C:\Windows\SysWOW64\timeout.exe
                                                                                              timeout 1
                                                                                              3⤵
                                                                                                PID:3472
                                                                                              • C:\Windows\SysWOW64\timeout.exe
                                                                                                timeout 1
                                                                                                3⤵
                                                                                                • Delays execution with timeout.exe
                                                                                                PID:4732
                                                                                              • C:\Windows\SysWOW64\timeout.exe
                                                                                                timeout 1
                                                                                                3⤵
                                                                                                • Delays execution with timeout.exe
                                                                                                PID:1920
                                                                                              • C:\Windows\SysWOW64\timeout.exe
                                                                                                timeout 1
                                                                                                3⤵
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                • Delays execution with timeout.exe
                                                                                                PID:4936
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c shadow.bat >NUL 2>NUL
                                                                                              2⤵
                                                                                                PID:3180
                                                                                            • C:\Windows\explorer.exe
                                                                                              explorer.exe
                                                                                              1⤵
                                                                                              • Boot or Logon Autostart Execution: Active Setup
                                                                                              • Modifies registry class
                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                              • Suspicious use of FindShellTrayWindow
                                                                                              • Suspicious use of SendNotifyMessage
                                                                                              PID:388

                                                                                            Network

                                                                                            MITRE ATT&CK Enterprise v15

                                                                                            Replay Monitor

                                                                                            Loading Replay Monitor...

                                                                                            Downloads

                                                                                            • C:\$Recycle.Bin\HOW_TO_DECRYPT.txt
                                                                                              Filesize

                                                                                              1KB

                                                                                              MD5

                                                                                              80207d0f8ea42bdfeaf9f5c586230aca

                                                                                              SHA1

                                                                                              747481fe2b0b6d81c3b19ba62d1e49eab6a5461f

                                                                                              SHA256

                                                                                              25edefb3b0678dfe0d927ff48ce67254359ba379df9468f634d02c026f0e7131

                                                                                              SHA512

                                                                                              73f68ce9e98d2346be1762bd54bb06ef83ae939dfbcf9b786d9b773fa454352613387d264b7a87a1c08950226553817bf01f5aa4107bc12de36a1689e2137304

                                                                                              Download Submit

                                                                                            • C:\$Recycle.Bin\S-1-5-21-2593460650-190333679-3676257533-1000\desktop.ini
                                                                                              Filesize

                                                                                              129B

                                                                                              MD5

                                                                                              c90b188a44f9565f0cb1b04c979a6a1e

                                                                                              SHA1

                                                                                              3c803fac44d8b021a59bfb91fd1418aa167c42e2

                                                                                              SHA256

                                                                                              803ed939abf940494406b22aa2dcf244c2c632c5ed1e97fd2ca96a1cebc5ce2a

                                                                                              SHA512

                                                                                              0d13ccd9e38e528448db830b5170a211912572b3c8bc110090183e9c9c948884ea3fa8d52d768db59f13ba37fdaed9ed9da511a975987cfe720373c9170cd23f

                                                                                              Download Submit

                                                                                            • C:\ProgramData\Microsoft\Windows\Caches\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db.WbcTxAPxA19RHktypwNtt9rxY0emvVxEPt3t05eDJ2E.hive
                                                                                              Filesize

                                                                                              622KB

                                                                                              MD5

                                                                                              6464592b77321c1e7f2c71d88407afe8

                                                                                              SHA1

                                                                                              adc74fb425e2b2c323b1bde036b63a0aab4a9b98

                                                                                              SHA256

                                                                                              846bf9ed14dc892f5a2e910300fa8fa3f82875f23c64dff2d61435dcdcd5b513

                                                                                              SHA512

                                                                                              bdad0f296ca8680bd8497ac4301b2d71adad4b967e7c84e0224324def4001030ee8e5e22683c621ffed3f3b453206b8fe940f7be90be1dc458fc90b16c467bee

                                                                                              Download Submit

                                                                                            • C:\Users\Admin\AppData\Local\Temp\hive.bat
                                                                                              Filesize

                                                                                              182B

                                                                                              MD5

                                                                                              b04d4c811903c7edc9e695e603b54edc

                                                                                              SHA1

                                                                                              411e5bba4ea1bcc40681535824aa9f77e97a7121

                                                                                              SHA256

                                                                                              29e5f50257e9597415e2cc3289e82e7d197ed1071769960167bad1196182f7d0

                                                                                              SHA512

                                                                                              733e999f48f11c64e171c9e2791a1845019de857522a0d4bcb9b756dca84b2b7608db2d59801f1353ae9f484962ff781df6f0fb271409b3ee838f3dd37947010

                                                                                              Download Submit

                                                                                            • C:\Users\Admin\AppData\Local\Temp\shadow.bat
                                                                                              Filesize

                                                                                              57B

                                                                                              MD5

                                                                                              df5552357692e0cba5e69f8fbf06abb6

                                                                                              SHA1

                                                                                              4714f1e6bb75a80a8faf69434726d176b70d7bd8

                                                                                              SHA256

                                                                                              d158f9d53e7c37eadd3b5cc1b82d095f61484e47eda2c36d9d35f31c0b4d3ff8

                                                                                              SHA512

                                                                                              a837555a1175ab515e2b43da9e493ff0ccd4366ee59defe6770327818ca9afa6f3e39ecdf5262b69253aa9e2692283ee8cebc97d58edd42e676977c7f73d143d

                                                                                              Download Submit

                                                                                            • memory/3760-10567-0x0000000000520000-0x0000000000783000-memory.dmp

                                                                                              Filesize

                                                                                              2.4MB

                                                                                              Download

                                                                                            • memory/3760-1-0x0000000000520000-0x0000000000783000-memory.dmp

                                                                                              Filesize

                                                                                              2.4MB

                                                                                              Download

                                                                                            • memory/3760-2515-0x0000000000520000-0x0000000000783000-memory.dmp

                                                                                              Filesize

                                                                                              2.4MB

                                                                                              Download

                                                                                            • memory/3760-4666-0x0000000000520000-0x0000000000783000-memory.dmp

                                                                                              Filesize

                                                                                              2.4MB

                                                                                              Download

                                                                                            • memory/3760-6853-0x0000000000520000-0x0000000000783000-memory.dmp

                                                                                              Filesize

                                                                                              2.4MB

                                                                                              Download

                                                                                            • memory/3760-0-0x0000000000520000-0x0000000000783000-memory.dmp

                                                                                              Filesize

                                                                                              2.4MB

                                                                                              Download

                                                                                            • memory/3760-15874-0x0000000000520000-0x0000000000783000-memory.dmp

                                                                                              Filesize

                                                                                              2.4MB

                                                                                              Download

                                                                                            • memory/3760-2-0x0000000000520000-0x0000000000783000-memory.dmp

                                                                                              Filesize

                                                                                              2.4MB

                                                                                              Download

                                                                                            • memory/3760-19727-0x0000000000520000-0x0000000000783000-memory.dmp

                                                                                              Filesize

                                                                                              2.4MB

                                                                                              Download

                                                                                            • memory/3760-22874-0x0000000000520000-0x0000000000783000-memory.dmp

                                                                                              Filesize

                                                                                              2.4MB

                                                                                              Download

                                                                                            • memory/3760-22875-0x0000000000520000-0x0000000000783000-memory.dmp

                                                                                              Filesize

                                                                                              2.4MB

                                                                                              Download

                                                                                            • memory/3760-23185-0x0000000000520000-0x0000000000783000-memory.dmp

                                                                                              Filesize

                                                                                              2.4MB

                                                                                              Download

                                                                                            • memory/3760-24274-0x0000000000520000-0x0000000000783000-memory.dmp

                                                                                              Filesize

                                                                                              2.4MB

                                                                                              Download

                                                                                            • memory/3760-24275-0x0000000000520000-0x0000000000783000-memory.dmp

                                                                                              Filesize

                                                                                              2.4MB

                                                                                              Download

                                                                                            • memory/3760-24276-0x0000000000520000-0x0000000000783000-memory.dmp

                                                                                              Filesize

                                                                                              2.4MB

                                                                                              Download

                                                                                            • memory/3760-24277-0x0000000000520000-0x0000000000783000-memory.dmp

                                                                                              Filesize

                                                                                              2.4MB

                                                                                              Download