Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

Ransomware...KB.exe

windows11-21h2-x64

10

Ransomware...KB.exe

windows7-x64

10

Ransomware...KB.exe

windows10-2004-x64

10

Ransomware...KB.exe

windows10-ltsc_2021-x64

10

Ransomware...KB.exe

windows11-21h2-x64

10

Ransomware...KB.exe

windows7-x64

10

Ransomware...KB.exe

windows7-x64

10

Ransomware...KB.exe

windows10-2004-x64

10

Ransomware...KB.exe

windows10-ltsc_2021-x64

10

Ransomware...KB.exe

windows11-21h2-x64

10

Ransomware...KB.exe

windows7-x64

5

Ransomware...KB.exe

windows7-x64

5

Ransomware...KB.exe

windows10-2004-x64

5

Ransomware...KB.exe

windows10-ltsc_2021-x64

5

Ransomware...KB.exe

windows11-21h2-x64

5

779389082

windows10-2004-x64

779389082

windows7-x64

779389082

windows10-2004-x64

779389082

windows10-ltsc_2021-x64

779389082

windows11-21h2-x64

Ransomware...KB.ps1

windows10-ltsc_2021-x64

Ransomware...KB.ps1

windows7-x64

Ransomware...KB.ps1

windows10-2004-x64

Ransomware...KB.ps1

windows10-ltsc_2021-x64

Ransomware...KB.ps1

windows11-21h2-x64

Ransomware...KB.ps1

windows11-21h2-x64

Ransomware...KB.ps1

windows7-x64

Ransomware...KB.ps1

windows10-2004-x64

Ransomware...KB.ps1

windows10-ltsc_2021-x64

Ransomware...KB.ps1

windows11-21h2-x64

Resubmissions

25/03/2025, 15:11

250325-skmbpsxzaw 10

25/03/2025, 15:06

250325-sg1d6a1px2 10

25/03/2025, 15:01

250325-sd5jpsxyct 10

25/03/2025, 14:56

250325-sbdcfaxxgs 10

25/03/2025, 14:50

250325-r7ve6a1nv3 10

25/03/2025, 14:46

250325-r5ab7sxwhx 10

25/03/2025, 14:40

250325-r2c9paxwe1 10

05/02/2025, 10:25

250205-mgcefaslhw 10

05/02/2025, 10:17

250205-mbs51atmbk 10

05/02/2025, 09:15

250205-k785zs1pfn 10

Analysis

  • max time kernel
    119s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20241023-en
  • resource tags

    arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
  • submitted
    25/03/2025, 14:40

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    RansomwareSamples/Hive_17_07_2021_808KB.exe

  • Size

    808KB

  • MD5

    504bd1695de326bc533fde29b8a69319

  • SHA1

    67f0c8d81aefcfc5943b31d695972194ac15e9f2

  • SHA256

    a0b4e3d7e4cd20d25ad2f92be954b95eea44f8f1944118a3194295c5677db749

  • SHA512

    18c5b28bafb13edf47f6a2b803d9d9a914945f037b266a765f2a324842c5ef04ebda27eba31851d2d63e00779a42900e0edfe4ad5bd817eb4f43fa4d4e3a4767

  • SSDEEP

    24576:lafTGwLNdRk4RBtr/ioF4/I+CMx3cMt3/4KFG8Qz4YwY:IT7dRFr/ioFjicMtvV4z

Score
10/10
hiveransomwareupx

Malware Config

Signatures

  • Detects Go variant of Hive Ransomware 1 IoCs
  • Hive

    A ransomware written in Golang first seen in June 2021.

    ransomwarehive
  • Hive family
    hive
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx

Processes

  • C:\Users\Admin\AppData\Local\Temp\RansomwareSamples\Hive_17_07_2021_808KB.exe
    C:\Users\Admin\AppData\Local\Temp\RansomwareSamples\Hive_17_07_2021_808KB.exe bcdedit /set shutdown /r /f /t 2
    1⤵
      PID:2124

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2124-0-0x0000000000CE0000-0x0000000000FB9000-memory.dmp

      Filesize

      2.8MB

      Download

    • memory/2124-2-0x0000000000CE0000-0x0000000000FB9000-memory.dmp

      Filesize

      2.8MB

      Download