Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

Ransomware...KB.exe

windows11-21h2-x64

10

Ransomware...KB.exe

windows7-x64

10

Ransomware...KB.exe

windows10-2004-x64

10

Ransomware...KB.exe

windows10-ltsc_2021-x64

10

Ransomware...KB.exe

windows11-21h2-x64

10

Ransomware...KB.exe

windows7-x64

10

Ransomware...KB.exe

windows7-x64

10

Ransomware...KB.exe

windows10-2004-x64

10

Ransomware...KB.exe

windows10-ltsc_2021-x64

10

Ransomware...KB.exe

windows11-21h2-x64

10

Ransomware...KB.exe

windows7-x64

5

Ransomware...KB.exe

windows7-x64

5

Ransomware...KB.exe

windows10-2004-x64

5

Ransomware...KB.exe

windows10-ltsc_2021-x64

5

Ransomware...KB.exe

windows11-21h2-x64

5

779389082

windows10-2004-x64

779389082

windows7-x64

779389082

windows10-2004-x64

779389082

windows10-ltsc_2021-x64

779389082

windows11-21h2-x64

Ransomware...KB.ps1

windows10-ltsc_2021-x64

Ransomware...KB.ps1

windows7-x64

Ransomware...KB.ps1

windows10-2004-x64

Ransomware...KB.ps1

windows10-ltsc_2021-x64

Ransomware...KB.ps1

windows11-21h2-x64

Ransomware...KB.ps1

windows11-21h2-x64

Ransomware...KB.ps1

windows7-x64

Ransomware...KB.ps1

windows10-2004-x64

Ransomware...KB.ps1

windows10-ltsc_2021-x64

Ransomware...KB.ps1

windows11-21h2-x64

Resubmissions

25/03/2025, 15:11 UTC

250325-skmbpsxzaw 10

25/03/2025, 15:06 UTC

250325-sg1d6a1px2 10

25/03/2025, 15:01 UTC

250325-sd5jpsxyct 10

25/03/2025, 14:56 UTC

250325-sbdcfaxxgs 10

25/03/2025, 14:50 UTC

250325-r7ve6a1nv3 10

25/03/2025, 14:46 UTC

250325-r5ab7sxwhx 10

25/03/2025, 14:40 UTC

250325-r2c9paxwe1 10

05/02/2025, 10:25 UTC

250205-mgcefaslhw 10

05/02/2025, 10:17 UTC

250205-mbs51atmbk 10

05/02/2025, 09:15 UTC

250205-k785zs1pfn 10

Analysis

  • max time kernel
    103s
  • max time network
    105s
  • platform
    windows10-ltsc_2021_x64
  • resource
    win10ltsc2021-20250314-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20250314-enlocale:en-usos:windows10-ltsc_2021-x64system
  • submitted
    25/03/2025, 14:40 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    RansomwareSamples/Hive_17_07_2021_808KB.exe

  • Size

    808KB

  • MD5

    504bd1695de326bc533fde29b8a69319

  • SHA1

    67f0c8d81aefcfc5943b31d695972194ac15e9f2

  • SHA256

    a0b4e3d7e4cd20d25ad2f92be954b95eea44f8f1944118a3194295c5677db749

  • SHA512

    18c5b28bafb13edf47f6a2b803d9d9a914945f037b266a765f2a324842c5ef04ebda27eba31851d2d63e00779a42900e0edfe4ad5bd817eb4f43fa4d4e3a4767

  • SSDEEP

    24576:lafTGwLNdRk4RBtr/ioF4/I+CMx3cMt3/4KFG8Qz4YwY:IT7dRFr/ioFjicMtvV4z

Score
10/10
hiveransomwareupx

Malware Config

Signatures

  • Detects Go variant of Hive Ransomware 1 IoCs
  • Hive

    A ransomware written in Golang first seen in June 2021.

    ransomwarehive
  • Hive family
    hive
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx

Processes

  • C:\Users\Admin\AppData\Local\Temp\RansomwareSamples\Hive_17_07_2021_808KB.exe
    C:\Users\Admin\AppData\Local\Temp\RansomwareSamples\Hive_17_07_2021_808KB.exe bcdedit /set shutdown /r /f /t 2
    1⤵
      PID:1744

    Network

    • flag-us
      DNS
      c.pki.goog
      Remote address:
      8.8.8.8:53
      Request
      c.pki.goog
      IN A
      Response
      c.pki.goog
      IN CNAME
      pki-goog.l.google.com
      pki-goog.l.google.com
      IN A
      142.250.179.227
    • flag-gb
      GET
      http://c.pki.goog/r/r1.crl
      Remote address:
      142.250.179.227:80
      Request
      GET /r/r1.crl HTTP/1.1
      Cache-Control: max-age = 3000
      Connection: Keep-Alive
      Accept: */*
      If-Modified-Since: Thu, 25 Jul 2024 14:48:00 GMT
      User-Agent: Microsoft-CryptoAPI/10.0
      Host: c.pki.goog
      Response
      HTTP/1.1 304 Not Modified
      Date: Tue, 25 Mar 2025 13:58:15 GMT
      Expires: Tue, 25 Mar 2025 14:48:15 GMT
      Last-Modified: Thu, 25 Jul 2024 14:48:00 GMT
      Cache-Control: public, max-age=3000
      Vary: Accept-Encoding
      Age: 2784
    • 142.250.179.227:80
      http://c.pki.goog/r/r1.crl
      http
      384 B
       355 B
       4
      3

      HTTP Request

      GET http://c.pki.goog/r/r1.crl

      HTTP Response

      304
    • 8.8.8.8:53
      c.pki.goog
      dns
      56 B
       107 B
       1
      1

      DNS Request

      c.pki.goog

      DNS Response

      142.250.179.227

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1744-0-0x0000000000870000-0x0000000000B49000-memory.dmp

      Filesize

      2.8MB

      Download

    • memory/1744-1-0x0000000000870000-0x0000000000B49000-memory.dmp

      Filesize

      2.8MB

      Download

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.