Analysis
- max time kernel
150s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260617-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
28/06/2026, 22:06
Behavioral task
behavioral1
Sample
2026-06-28_65610f31d12fcd4284314123269da5ec_hive.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-28_65610f31d12fcd4284314123269da5ec_hive.exe
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target 2026-06-28_65610f31d12fcd4284314123269da5ec_hive.exe
- Size 2.1MB
- Sample260628-11cffae14z
- SHA256 18d230d4d1fd9f024721c992b13e8a09f26860a42221924a207fefd65258de32
- MD5 65610f31d12fcd4284314123269da5ec
- SHA1 ba0654b8fdc37e2b3e5b5fa691ae6a58ec171a71
- SHA512 795d9773e60f8db9a6f1191d7c4e2a7494000897825ad57ca5398e64a348e4c430bab7134669baff57a4e17f98e47ad62f2616adf554c31f29892546db3407c0
- SSDEEP 49152:Q1Ymm3/zMb84Cy0ZZUwi+O4MY/+qdxK32s9GMetxE4pF4iU1qWevAJ0owlX:QEbMLCLZXH9+FGBt24pssWevPouX
- TLSH T172A53317CE437DA0D808EC71B71B0389355D8214D69816A950AF3A63D392B7F66B22FF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables referencing many IR and analysis tools 16 IoCs
resource yara_rule behavioral2/memory/1544-34-0x00007FF68F680000-0x00007FF691D9C000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools behavioral2/memory/2568-40-0x00007FF72C9E0000-0x00007FF72F0FC000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools behavioral2/memory/2568-41-0x00007FF72C9E0000-0x00007FF72F0FC000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools behavioral2/memory/2568-42-0x00007FF72C9E0000-0x00007FF72F0FC000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools behavioral2/memory/2568-43-0x00007FF72C9E0000-0x00007FF72F0FC000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools behavioral2/memory/2568-44-0x00007FF72C9E0000-0x00007FF72F0FC000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools behavioral2/memory/2568-45-0x00007FF72C9E0000-0x00007FF72F0FC000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools behavioral2/memory/2568-46-0x00007FF72C9E0000-0x00007FF72F0FC000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools behavioral2/memory/2568-47-0x00007FF72C9E0000-0x00007FF72F0FC000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools behavioral2/memory/2568-48-0x00007FF72C9E0000-0x00007FF72F0FC000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools behavioral2/memory/2568-49-0x00007FF72C9E0000-0x00007FF72F0FC000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools behavioral2/memory/2568-50-0x00007FF72C9E0000-0x00007FF72F0FC000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools behavioral2/memory/2568-51-0x00007FF72C9E0000-0x00007FF72F0FC000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools behavioral2/memory/2568-52-0x00007FF72C9E0000-0x00007FF72F0FC000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools behavioral2/memory/2568-53-0x00007FF72C9E0000-0x00007FF72F0FC000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools behavioral2/memory/2568-54-0x00007FF72C9E0000-0x00007FF72F0FC000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools - Detects executables referencing virtualization MAC addresses 16 IoCs
resource yara_rule behavioral2/memory/1544-34-0x00007FF68F680000-0x00007FF691D9C000-memory.dmp INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb behavioral2/memory/2568-40-0x00007FF72C9E0000-0x00007FF72F0FC000-memory.dmp INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb behavioral2/memory/2568-41-0x00007FF72C9E0000-0x00007FF72F0FC000-memory.dmp INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb behavioral2/memory/2568-42-0x00007FF72C9E0000-0x00007FF72F0FC000-memory.dmp INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb behavioral2/memory/2568-43-0x00007FF72C9E0000-0x00007FF72F0FC000-memory.dmp INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb behavioral2/memory/2568-44-0x00007FF72C9E0000-0x00007FF72F0FC000-memory.dmp INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb behavioral2/memory/2568-45-0x00007FF72C9E0000-0x00007FF72F0FC000-memory.dmp INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb behavioral2/memory/2568-46-0x00007FF72C9E0000-0x00007FF72F0FC000-memory.dmp INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb behavioral2/memory/2568-47-0x00007FF72C9E0000-0x00007FF72F0FC000-memory.dmp INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb behavioral2/memory/2568-48-0x00007FF72C9E0000-0x00007FF72F0FC000-memory.dmp INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb behavioral2/memory/2568-49-0x00007FF72C9E0000-0x00007FF72F0FC000-memory.dmp INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb behavioral2/memory/2568-50-0x00007FF72C9E0000-0x00007FF72F0FC000-memory.dmp INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb behavioral2/memory/2568-51-0x00007FF72C9E0000-0x00007FF72F0FC000-memory.dmp INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb behavioral2/memory/2568-52-0x00007FF72C9E0000-0x00007FF72F0FC000-memory.dmp INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb behavioral2/memory/2568-53-0x00007FF72C9E0000-0x00007FF72F0FC000-memory.dmp INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb behavioral2/memory/2568-54-0x00007FF72C9E0000-0x00007FF72F0FC000-memory.dmp INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb - UPX dump on OEP (original entry point) 19 IoCs
resource yara_rule behavioral2/memory/1544-0-0x00007FF68F680000-0x00007FF691D9C000-memory.dmp UPX behavioral2/files/0x0005000000016cfd-21.dat UPX behavioral2/memory/1544-34-0x00007FF68F680000-0x00007FF691D9C000-memory.dmp UPX behavioral2/memory/2568-39-0x00007FF72C9E0000-0x00007FF72F0FC000-memory.dmp UPX behavioral2/memory/2568-40-0x00007FF72C9E0000-0x00007FF72F0FC000-memory.dmp UPX behavioral2/memory/2568-41-0x00007FF72C9E0000-0x00007FF72F0FC000-memory.dmp UPX behavioral2/memory/2568-42-0x00007FF72C9E0000-0x00007FF72F0FC000-memory.dmp UPX behavioral2/memory/2568-43-0x00007FF72C9E0000-0x00007FF72F0FC000-memory.dmp UPX behavioral2/memory/2568-44-0x00007FF72C9E0000-0x00007FF72F0FC000-memory.dmp UPX behavioral2/memory/2568-45-0x00007FF72C9E0000-0x00007FF72F0FC000-memory.dmp UPX behavioral2/memory/2568-46-0x00007FF72C9E0000-0x00007FF72F0FC000-memory.dmp UPX behavioral2/memory/2568-47-0x00007FF72C9E0000-0x00007FF72F0FC000-memory.dmp UPX behavioral2/memory/2568-48-0x00007FF72C9E0000-0x00007FF72F0FC000-memory.dmp UPX behavioral2/memory/2568-49-0x00007FF72C9E0000-0x00007FF72F0FC000-memory.dmp UPX behavioral2/memory/2568-50-0x00007FF72C9E0000-0x00007FF72F0FC000-memory.dmp UPX behavioral2/memory/2568-51-0x00007FF72C9E0000-0x00007FF72F0FC000-memory.dmp UPX behavioral2/memory/2568-52-0x00007FF72C9E0000-0x00007FF72F0FC000-memory.dmp UPX behavioral2/memory/2568-53-0x00007FF72C9E0000-0x00007FF72F0FC000-memory.dmp UPX behavioral2/memory/2568-54-0x00007FF72C9E0000-0x00007FF72F0FC000-memory.dmp UPX - Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to get system information as a root user.
pid Process 2824 powershell.exe 3576 powershell.exe - Executes dropped EXE 1 IoCs
pid Process 2568 svchost.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdateService = "C:\\Users\\Admin\\AppData\\Roaming\\WindowsUpdateService\\svchost.exe" 2026-06-28_65610f31d12fcd4284314123269da5ec_hive.exe - Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 1 api.ipify.org 5 api.ipify.org -
resource yara_rule behavioral2/memory/1544-0-0x00007FF68F680000-0x00007FF691D9C000-memory.dmp upx behavioral2/files/0x0005000000016cfd-21.dat upx behavioral2/memory/1544-34-0x00007FF68F680000-0x00007FF691D9C000-memory.dmp upx behavioral2/memory/2568-39-0x00007FF72C9E0000-0x00007FF72F0FC000-memory.dmp upx behavioral2/memory/2568-40-0x00007FF72C9E0000-0x00007FF72F0FC000-memory.dmp upx behavioral2/memory/2568-41-0x00007FF72C9E0000-0x00007FF72F0FC000-memory.dmp upx behavioral2/memory/2568-42-0x00007FF72C9E0000-0x00007FF72F0FC000-memory.dmp upx behavioral2/memory/2568-43-0x00007FF72C9E0000-0x00007FF72F0FC000-memory.dmp upx behavioral2/memory/2568-44-0x00007FF72C9E0000-0x00007FF72F0FC000-memory.dmp upx behavioral2/memory/2568-45-0x00007FF72C9E0000-0x00007FF72F0FC000-memory.dmp upx behavioral2/memory/2568-46-0x00007FF72C9E0000-0x00007FF72F0FC000-memory.dmp upx behavioral2/memory/2568-47-0x00007FF72C9E0000-0x00007FF72F0FC000-memory.dmp upx behavioral2/memory/2568-48-0x00007FF72C9E0000-0x00007FF72F0FC000-memory.dmp upx behavioral2/memory/2568-49-0x00007FF72C9E0000-0x00007FF72F0FC000-memory.dmp upx behavioral2/memory/2568-50-0x00007FF72C9E0000-0x00007FF72F0FC000-memory.dmp upx behavioral2/memory/2568-51-0x00007FF72C9E0000-0x00007FF72F0FC000-memory.dmp upx behavioral2/memory/2568-52-0x00007FF72C9E0000-0x00007FF72F0FC000-memory.dmp upx behavioral2/memory/2568-53-0x00007FF72C9E0000-0x00007FF72F0FC000-memory.dmp upx behavioral2/memory/2568-54-0x00007FF72C9E0000-0x00007FF72F0FC000-memory.dmp upx - GoLang User-Agent 1 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
description flow ioc HTTP User-Agent header 8 Go-http-client/1.1 - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1544 2026-06-28_65610f31d12fcd4284314123269da5ec_hive.exe 1544 2026-06-28_65610f31d12fcd4284314123269da5ec_hive.exe 1544 2026-06-28_65610f31d12fcd4284314123269da5ec_hive.exe 1544 2026-06-28_65610f31d12fcd4284314123269da5ec_hive.exe 2824 powershell.exe 2824 powershell.exe 2568 svchost.exe 2568 svchost.exe 2568 svchost.exe 2568 svchost.exe 3576 powershell.exe 3576 powershell.exe 3576 powershell.exe 2568 svchost.exe 2568 svchost.exe 2568 svchost.exe 2568 svchost.exe 2568 svchost.exe 2568 svchost.exe 2568 svchost.exe 2568 svchost.exe 2568 svchost.exe 2568 svchost.exe 2568 svchost.exe 2568 svchost.exe 2568 svchost.exe 2568 svchost.exe 2568 svchost.exe 2568 svchost.exe 2568 svchost.exe 2568 svchost.exe 2568 svchost.exe 2568 svchost.exe 2568 svchost.exe 2568 svchost.exe 2568 svchost.exe 2568 svchost.exe 2568 svchost.exe 2568 svchost.exe 2568 svchost.exe 2568 svchost.exe 2568 svchost.exe 2568 svchost.exe 2568 svchost.exe 2568 svchost.exe 2568 svchost.exe 2568 svchost.exe 2568 svchost.exe 2568 svchost.exe 2568 svchost.exe 2568 svchost.exe 2568 svchost.exe 2568 svchost.exe 2568 svchost.exe 2568 svchost.exe 2568 svchost.exe 2568 svchost.exe 2568 svchost.exe 2568 svchost.exe 2568 svchost.exe 2568 svchost.exe 2568 svchost.exe 2568 svchost.exe 2568 svchost.exe - Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeDebugPrivilege 1544 2026-06-28_65610f31d12fcd4284314123269da5ec_hive.exe Token: SeDebugPrivilege 2824 powershell.exe Token: SeDebugPrivilege 2568 svchost.exe Token: SeIncreaseQuotaPrivilege 2824 powershell.exe Token: SeSecurityPrivilege 2824 powershell.exe Token: SeTakeOwnershipPrivilege 2824 powershell.exe Token: SeLoadDriverPrivilege 2824 powershell.exe Token: SeSystemProfilePrivilege 2824 powershell.exe Token: SeSystemtimePrivilege 2824 powershell.exe Token: SeProfSingleProcessPrivilege 2824 powershell.exe Token: SeIncBasePriorityPrivilege 2824 powershell.exe Token: SeCreatePagefilePrivilege 2824 powershell.exe Token: SeBackupPrivilege 2824 powershell.exe Token: SeRestorePrivilege 2824 powershell.exe Token: SeShutdownPrivilege 2824 powershell.exe Token: SeDebugPrivilege 2824 powershell.exe Token: SeSystemEnvironmentPrivilege 2824 powershell.exe Token: SeRemoteShutdownPrivilege 2824 powershell.exe Token: SeUndockPrivilege 2824 powershell.exe Token: SeManageVolumePrivilege 2824 powershell.exe Token: 33 2824 powershell.exe Token: 34 2824 powershell.exe Token: 35 2824 powershell.exe Token: 36 2824 powershell.exe Token: SeDebugPrivilege 3576 powershell.exe Token: SeIncreaseQuotaPrivilege 3576 powershell.exe Token: SeSecurityPrivilege 3576 powershell.exe Token: SeTakeOwnershipPrivilege 3576 powershell.exe Token: SeLoadDriverPrivilege 3576 powershell.exe Token: SeSystemProfilePrivilege 3576 powershell.exe Token: SeSystemtimePrivilege 3576 powershell.exe Token: SeProfSingleProcessPrivilege 3576 powershell.exe Token: SeIncBasePriorityPrivilege 3576 powershell.exe Token: SeCreatePagefilePrivilege 3576 powershell.exe Token: SeBackupPrivilege 3576 powershell.exe Token: SeRestorePrivilege 3576 powershell.exe Token: SeShutdownPrivilege 3576 powershell.exe Token: SeDebugPrivilege 3576 powershell.exe Token: SeSystemEnvironmentPrivilege 3576 powershell.exe Token: SeRemoteShutdownPrivilege 3576 powershell.exe Token: SeUndockPrivilege 3576 powershell.exe Token: SeManageVolumePrivilege 3576 powershell.exe Token: 33 3576 powershell.exe Token: 34 3576 powershell.exe Token: 35 3576 powershell.exe Token: 36 3576 powershell.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1544 wrote to memory of 2824 1544 2026-06-28_65610f31d12fcd4284314123269da5ec_hive.exe 89 PID 1544 wrote to memory of 2568 1544 2026-06-28_65610f31d12fcd4284314123269da5ec_hive.exe 92 PID 2568 wrote to memory of 3576 2568 svchost.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-28_65610f31d12fcd4284314123269da5ec_hive.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-28_65610f31d12fcd4284314123269da5ec_hive.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1544 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntivirusProduct).displayName -join ', '"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2824
-
-
C:\Users\Admin\AppData\Roaming\WindowsUpdateService\svchost.exeC:\Users\Admin\AppData\Roaming\WindowsUpdateService\svchost.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntivirusProduct).displayName -join ', '"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3576
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 dcf0b6b9ceae7e42f33fa311e6f2f7e9cddcbc2f7cc99020cd1225cb5255f1d7
- MD5 ff716885cfab581801ade5f78056e885
- SHA1 c7a0f18e5f661d54157995429aa32a7cdb074214
- SHA512 10c5af78c7cf4792dfa7e48910dd89e6ce1ce1df483512cd9e2ac743ca9d7e2c9a95202a5816613b6ad1842fb8cbf50d225d466ea61b88e8548e1031e07f71eb
- TLSH T1A6217633F3DC8694C899013A10DDAC1032B7C7CB40DECF9B6B85D129A42F699CF61060
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_aud4royv.lha.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\WindowsUpdateService\svchost.exe
- Size 2.1MB
- SHA256 18d230d4d1fd9f024721c992b13e8a09f26860a42221924a207fefd65258de32
- MD5 65610f31d12fcd4284314123269da5ec
- SHA1 ba0654b8fdc37e2b3e5b5fa691ae6a58ec171a71
- SHA512 795d9773e60f8db9a6f1191d7c4e2a7494000897825ad57ca5398e64a348e4c430bab7134669baff57a4e17f98e47ad62f2616adf554c31f29892546db3407c0
- SSDEEP 49152:Q1Ymm3/zMb84Cy0ZZUwi+O4MY/+qdxK32s9GMetxE4pF4iU1qWevAJ0owlX:QEbMLCLZXH9+FGBt24pssWevPouX
- TLSH T172A53317CE437DA0D808EC71B71B0389355D8214D69816A950AF3A63D392B7F66B22FF
- MD5 SHA1 SHA512 SSDEEP TLSH