Analysis
- max time kernel
148s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
04/10/2026, 17:58
General
- Target 2026-10-03_15281b88adedb860dae9d335a80ff8de_hive.exe
- Size 4.4MB
- Sample261004-wkavfstfkf
- SHA256 5084876479bbbfb818033085cba362a3eaee8b784db172271f4cdba0243a3e88
Score
10/10
Malware Config
Signatures
- Family: WebRAT
WebRAT is a Windows RAT written in Golang.
- Custom signatureDetects executables containing SQL queries to confidential data stores. Observed in infostealers 32 IoCs
- Custom signatureDetects executables referencing many IR and analysis tools 32 IoCs
- Custom signatureDetects executables referencing many confidential data stores found in browsers, mail clients, crypt 32 IoCs
- Custom signatureDetects executables referencing virtualization MAC addresses 32 IoCs
- Custom signatureUPX dump on OEP (original entry point) 35 IoCs
- Custom signaturedetects Windows exceutables potentially bypassing UAC using fodhelper.exe 32 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell and hide display window.
- Executes dropped EXE 3 IoCs
- Checks whether UAC is enabled 1 TTPs 3 IoCs
- Enumerates connected drives 3 TTPs 4 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Discovers running processes 1 TTPs 64 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
- UPX packed file 35 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 12 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-03_15281b88adedb860dae9d335a80ff8de_hive.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-03_15281b88adedb860dae9d335a80ff8de_hive.exe"1⤵
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq wireshark.exe" /NH2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq dumpcap.exe" /NH2⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq procmon.exe" /NH2⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq procmon64.exe" /NH2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq procexp.exe" /NH2⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq procexp64.exe" /NH2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq processhacker.exe" /NH2⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq x64dbg.exe" /NH2⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq x32dbg.exe" /NH2⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq ollydbg.exe" /NH2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq ida.exe" /NH2⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq ida64.exe" /NH2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq idag.exe" /NH2⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq idag64.exe" /NH2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq idaw.exe" /NH2⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq idaw64.exe" /NH2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq fiddler.exe" /NH2⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq httpdebugger.exe" /NH2⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq httpdebuggerui.exe" /NH2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq dnspy.exe" /NH2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq pestudio.exe" /NH2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq cheatengine.exe" /NH2⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq hxd.exe" /NH2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq devenv.exe" /NH2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq windbg.exe" /NH2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq immunitydebugger.exe" /NH2⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq apimonitor.exe" /NH2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq autoruns.exe" /NH2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq autorunsc.exe" /NH2⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq filemon.exe" /NH2⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq regmon.exe" /NH2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq resourcehacker.exe" /NH2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq vmtoolsd.exe" /NH2⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq vmwaretray.exe" /NH2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq vmwareuser.exe" /NH2⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq vmusrvc.exe" /NH2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq vmsrvc.exe" /NH2⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq vboxservice.exe" /NH2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq vboxtray.exe" /NH2⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq xenservice.exe" /NH2⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq qemu-ga.exe" /NH2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq sandboxie.exe" /NH2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq sandboxiedcomlaunch.exe" /NH2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq sandboxierpcss.exe" /NH2⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq joeboxcontrol.exe" /NH2⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq joeboxserver.exe" /NH2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq prl_tools.exe" /NH2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq prl_cc.exe" /NH2⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq vmacthlp.exe" /NH2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\schtasks.exeschtasks /Create /XML C:\Users\Admin\AppData\Local\Temp\2026-10-03_15281b88adedb860dae9d335a80ff8de_hive_task.xml /TN 2026-10-03_15281b88adedb860dae9d335a80ff8de_hive /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\2026-10-03_15281b88adedb860dae9d335a80ff8de_hive.exeC:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\2026-10-03_15281b88adedb860dae9d335a80ff8de_hive.exe --installed2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq wireshark.exe" /NH3⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq dumpcap.exe" /NH3⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq procmon.exe" /NH3⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq procmon64.exe" /NH3⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq procexp.exe" /NH3⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq procexp64.exe" /NH3⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq processhacker.exe" /NH3⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq x64dbg.exe" /NH3⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq x32dbg.exe" /NH3⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq ollydbg.exe" /NH3⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq ida.exe" /NH3⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq ida64.exe" /NH3⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq idag.exe" /NH3⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq idag64.exe" /NH3⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq idaw.exe" /NH3⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq idaw64.exe" /NH3⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq fiddler.exe" /NH3⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq httpdebugger.exe" /NH3⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq httpdebuggerui.exe" /NH3⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq dnspy.exe" /NH3⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq pestudio.exe" /NH3⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq cheatengine.exe" /NH3⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq hxd.exe" /NH3⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq devenv.exe" /NH3⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq windbg.exe" /NH3⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq immunitydebugger.exe" /NH3⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq apimonitor.exe" /NH3⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq autoruns.exe" /NH3⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq autorunsc.exe" /NH3⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq filemon.exe" /NH3⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq regmon.exe" /NH3⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq resourcehacker.exe" /NH3⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq vmtoolsd.exe" /NH3⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq vmwaretray.exe" /NH3⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq vmwareuser.exe" /NH3⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq vmusrvc.exe" /NH3⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq vmsrvc.exe" /NH3⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq vboxservice.exe" /NH3⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq vboxtray.exe" /NH3⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq xenservice.exe" /NH3⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq qemu-ga.exe" /NH3⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq sandboxie.exe" /NH3⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq sandboxiedcomlaunch.exe" /NH3⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq sandboxierpcss.exe" /NH3⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq joeboxcontrol.exe" /NH3⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq joeboxserver.exe" /NH3⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq prl_tools.exe" /NH3⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq prl_cc.exe" /NH3⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq vmacthlp.exe" /NH3⤵
- Discovers running processes
-
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\2026-10-03_15281b88adedb860dae9d335a80ff8de_hive.exeC:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\2026-10-03_15281b88adedb860dae9d335a80ff8de_hive.exe1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq wireshark.exe" /NH2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq dumpcap.exe" /NH2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq procmon.exe" /NH2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq procmon64.exe" /NH2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq procexp.exe" /NH2⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq procexp64.exe" /NH2⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq processhacker.exe" /NH2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq x64dbg.exe" /NH2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq x32dbg.exe" /NH2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq ollydbg.exe" /NH2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq ida.exe" /NH2⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq ida64.exe" /NH2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq idag.exe" /NH2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq idag64.exe" /NH2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq idaw.exe" /NH2⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq idaw64.exe" /NH2⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq fiddler.exe" /NH2⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq httpdebugger.exe" /NH2⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq httpdebuggerui.exe" /NH2⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq dnspy.exe" /NH2⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq pestudio.exe" /NH2⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq cheatengine.exe" /NH2⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq hxd.exe" /NH2⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq devenv.exe" /NH2⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq windbg.exe" /NH2⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq immunitydebugger.exe" /NH2⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq apimonitor.exe" /NH2⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq autoruns.exe" /NH2⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq autorunsc.exe" /NH2⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq filemon.exe" /NH2⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq regmon.exe" /NH2⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq resourcehacker.exe" /NH2⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq vmtoolsd.exe" /NH2⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq vmwaretray.exe" /NH2⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq vmwareuser.exe" /NH2⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq vmusrvc.exe" /NH2⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq vmsrvc.exe" /NH2⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq vboxservice.exe" /NH2⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq vboxtray.exe" /NH2⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq xenservice.exe" /NH2⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq qemu-ga.exe" /NH2⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq sandboxie.exe" /NH2⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq sandboxiedcomlaunch.exe" /NH2⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq sandboxierpcss.exe" /NH2⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq joeboxcontrol.exe" /NH2⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq joeboxserver.exe" /NH2⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq prl_tools.exe" /NH2⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq prl_cc.exe" /NH2⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq vmacthlp.exe" /NH2⤵
- Discovers running processes
-
-
C:\Windows\system32\schtasks.exeschtasks /Create /XML C:\Users\Admin\AppData\Local\Temp\2026-10-03_15281b88adedb860dae9d335a80ff8de_hive_task.xml /TN 2026-10-03_15281b88adedb860dae9d335a80ff8de_hive /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\2026-10-03_15281b88adedb860dae9d335a80ff8de_hive.exeC:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\2026-10-03_15281b88adedb860dae9d335a80ff8de_hive.exe --watchdog 2472 --wd-target C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\2026-10-03_15281b88adedb860dae9d335a80ff8de_hive.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject -Query \"select Name from Win32_Processor\").Name"2⤵
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject -Query \"Select Name from Win32_VideoController\").Name"2⤵
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject -Query \"select Caption from Win32_OperatingSystem\").Caption"2⤵
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject -Query \"select TotalPhysicalMemory from Win32_ComputerSystem\").TotalPhysicalMemory"2⤵
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
2026-10-03_15281b88adedb860dae9d335a80ff8de_hive.exe
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
2026-10-03_15281b88adedb860dae9d335a80ff8de_hive_task.xml
__PSScriptPolicyTest_nswpvwrv.2hw.ps1
wruntime.log
wruntime.log
wruntime.log
memory/1328-23-0x000002184B490000-0x000002184B4B2000-memory.dmp
memory/1952-0-0x0000000000080000-0x0000000000EA6000-memory.dmp
memory/1952-9-0x0000000000080000-0x0000000000EA6000-memory.dmp
memory/2360-67-0x00000000007A0000-0x00000000015C6000-memory.dmp
memory/2360-79-0x00000000007A0000-0x00000000015C6000-memory.dmp
memory/2360-87-0x00000000007A0000-0x00000000015C6000-memory.dmp
memory/2360-85-0x00000000007A0000-0x00000000015C6000-memory.dmp
memory/2360-59-0x00000000007A0000-0x00000000015C6000-memory.dmp
memory/2360-83-0x00000000007A0000-0x00000000015C6000-memory.dmp
memory/2360-81-0x00000000007A0000-0x00000000015C6000-memory.dmp
memory/2360-77-0x00000000007A0000-0x00000000015C6000-memory.dmp
memory/2360-64-0x00000000007A0000-0x00000000015C6000-memory.dmp
memory/2360-75-0x00000000007A0000-0x00000000015C6000-memory.dmp
memory/2360-73-0x00000000007A0000-0x00000000015C6000-memory.dmp
memory/2360-71-0x00000000007A0000-0x00000000015C6000-memory.dmp
memory/2360-69-0x00000000007A0000-0x00000000015C6000-memory.dmp
memory/2472-78-0x00000000007A0000-0x00000000015C6000-memory.dmp
memory/2472-80-0x00000000007A0000-0x00000000015C6000-memory.dmp
memory/2472-72-0x00000000007A0000-0x00000000015C6000-memory.dmp
memory/2472-56-0x00000000007A0000-0x00000000015C6000-memory.dmp
memory/2472-74-0x00000000007A0000-0x00000000015C6000-memory.dmp
memory/2472-65-0x00000000007A0000-0x00000000015C6000-memory.dmp
memory/2472-76-0x00000000007A0000-0x00000000015C6000-memory.dmp
memory/2472-88-0x00000000007A0000-0x00000000015C6000-memory.dmp
memory/2472-68-0x00000000007A0000-0x00000000015C6000-memory.dmp
memory/2472-70-0x00000000007A0000-0x00000000015C6000-memory.dmp
memory/2472-86-0x00000000007A0000-0x00000000015C6000-memory.dmp
memory/2472-84-0x00000000007A0000-0x00000000015C6000-memory.dmp
memory/2472-82-0x00000000007A0000-0x00000000015C6000-memory.dmp
memory/2472-60-0x00000000007A0000-0x00000000015C6000-memory.dmp
memory/5076-61-0x00000000007A0000-0x00000000015C6000-memory.dmp
memory/5076-57-0x00000000007A0000-0x00000000015C6000-memory.dmp
memory/5076-10-0x00000000007A0000-0x00000000015C6000-memory.dmp
memory/5076-58-0x00000000007A0000-0x00000000015C6000-memory.dmp
memory/5076-63-0x00000000007A0000-0x00000000015C6000-memory.dmp