{"id":1391,"date":"2021-09-22T13:51:31","date_gmt":"2021-09-22T05:51:31","guid":{"rendered":"https:\/\/blog.billows.com.tw\/?p=1391"},"modified":"2021-11-09T09:40:19","modified_gmt":"2021-11-09T01:40:19","slug":"%e7%99%bc%e7%8f%behive%e5%8b%92%e7%b4%a2%e8%bb%9f%e9%ab%94%e9%a6%96%e5%ba%a6%e5%85%a5%e4%be%b5%e5%8f%b0%e7%81%a3%ef%bc%8c%e6%9f%90%e7%9f%a5%e5%90%8d%e9%8b%bc%e9%90%b5%e5%85%ac%e5%8f%b8%e9%81%ad","status":"publish","type":"post","link":"https:\/\/blog.billows.com.tw\/?p=1391","title":{"rendered":"\u767c\u73feHive\u52d2\u7d22\u8edf\u9ad4\u9996\u5ea6\u5165\u4fb5\u53f0\u7063\uff0c\u67d0\u77e5\u540d\u92fc\u9435\u516c\u53f8\u906d\u99ed"},"content":{"rendered":"\n
\"\"<\/figure>\n\n\n\n

\u9996\u898bHive\u52d2\u7d22\u8edf\u9ad4\u5165\u4fb5\u53f0\u7063\uff0c\u5728Hive\u7684\u63ed\u79d8\u7db2\u7ad9Hive leaks\u4e0a\u767c\u73fe\u570b\u5167\u67d0\u77e5\u540d\u4e0a\u5e02\u92fc\u9435\u516c\u53f8\u5df2\u88abHive\u5217\u5165\u53d7\u5bb3\u8005\u540d\u55ae\uff0cHive\u4e5f\u540c\u6642\u767c\u4f48\u4e86\u5176\u76f8\u95dc\u8cc7\u6599\uff0c\u76ee\u524d\u4ecd\u7121\u6cd5\u78ba\u8a8dHive\u5728\u9019\u5872\u653b\u64ca\u4e2d\u662f\u52a0\u5bc6\u5c11\u91cf\u6216\u662f\u5168\u90e8\u4f3a\u670d\u5668\uff0c\u662f\u5426\u5df2\u53d6\u5f97\u50f9\u503c\u6027\u53ca\u6a5f\u5bc6\u6027\u9ad8\u7684\u6a94\u6848\u7b49\uff0c\u4f46\u64da\u76f8\u4fe1\u8a72\u4e0a\u5e02\u516c\u53f8\u662f\u57289\u67084\u65e5\u906dHive\u52a0\u5bc6\uff0cHive\u76f4\u52309\u670819\u65e5\u516c\u5e03\u92fc\u9435\u4f01\u696d\u7684\u8cc7\u6599\u3002<\/p>\n\n\n\n

\u4e00\u822c\u4f86\u8aaa\uff0c\u52d2\u7d22\u8edf\u9ad4\u7d44\u7e54\u516c\u4f48\u53d7\u5bb3\u8005\u7684\u8cc7\u6599\u662f\u7528\u4f5c\u5a01\u8105\u5c0d\u65b9\u8207\u5176\u8ac7\u5224\uff0c\u7136\u800c\u76ee\u524dHive\u4ecd\u672a\u516c\u958b\u5c0d\u6b64\u53f0\u7063\u4f01\u696d\u7684\u52d2\u7d22\u91d1\u984d\uff0cHive\u662f\u4e00\u500b\u76f8\u5c0d\u8f03\u65b0\u7684\u52d2\u7d22\u8edf\u9ad4\uff0c\u65bc\u4eca\u5e746\u6708\u80fd\u9996\u6b21\u6d6e\u51fa\u6c34\u9762\uff0c\u5728\u77ed\u77ed3\u500b\u6708\u5df2\u51fa\u73fe\u81f3\u5c1130\u500b\u53d7\u5bb3\u516c\u53f8\uff0cFBI\u65bc8\u6708\u767c\u4f48Flash Alert<\/a>\uff0c\u8b66\u544aHive\u9396\u5b9a\u91ab\u7642\u4fdd\u5065\u548c\u7121\u6cd5\u56e0\u61c9\u52d2\u7d22\u8edf\u9ad4\u653b\u64ca\u7684\u4f01\u696d\u800c\u4f86\uff0c\u6839\u64daFBI\u8b66\u5831\uff0cHive\u52d2\u7d22\u8edf\u9ad4\u4f7f\u7528\u591a\u7a2e\u6a5f\u5236\u4f86\u5165\u4fb5\u4f01\u696d\u7db2\u8def\u3001\u52a0\u5bc6\u6578\u64da\u548c\u5916\u6d29\u6578\u64da\uff0c\u5305\u62ec\u4f7f\u7528\u5e36\u6709\u60e1\u610f\u9644\u4ef6\u7684\u91e3\u9b5a\u90f5\u4ef6\u7372\u53d6\u5b58\u53d6\u6b0a\u9650\u548c\u5229\u7528\u9060\u7aef\u684c\u9762\u5354\u8b70\u5728\u7db2\u8def\u4e2d\u6a6b\u5411\u79fb\u52d5\u30028\u670815\u65e5<\/a>\uff0c\u7f8e\u570b\u897f\u7dad\u5409\u5c3c\u4e9e\u5dde\u53ca\u4fc4\u4ea5\u4fc4\u5dde\u7684\u9023\u9396\u91ab\u7642\u7cfb\u7d71Memorial Healthcare System<\/a>\u70ba\u4e86\u6062\u5fa9\u516b\u767e\u53f0\u4f3a\u670d\u5668\u3001\u4e09\u5343\u591a\u53f0\u500b\u4eba\u8a2d\u5099\u4e26\u4ee5\u9632\u6b62200,000\u540d\u60a3\u8005\u7684\u8cc7\u6599\u5916\u6d29\uff0cMemorial Health System\u7e3d\u88c1 Scott Cantley\u57288\u670818\u65e5\uff0c\u627f\u8a8d\u652f\u4ed8\u8d16\u91d1\u4ee5\u63db\u53d6\u89e3\u5bc6\u91d1\u9470\u3002\u57289 \u6708\u521d\uff0c\u7f8e\u570b\u5bc6\u8607\u91cc\u6d32(Missouri)\u7684Delta Medical Center\u91ab\u7642\u4e2d\u5fc3<\/a>\u7684\u4e00\u53f0\u4f3a\u670d\u5668\u4e0a\u7684\u6a5f\u5bc6\u60a3\u8005\u6578\u64da\u906dHive\u7aca\u53d6\u4e26\u65bc 9 \u6708 9 \u65e5\u767c\u5e03\u60a3\u8005\u59d3\u540d\u3001\u793e\u6703\u5b89\u5168\u865f\u78bc(Social Security Numbers)\u548c\u91ab\u7642\u8cc7\u8a0a\u7b49\uff0c\u662f\u503c\u5f97\u91ab\u7642\u6a5f\u69cb\u95dc\u6ce8\u7684\u52d2\u7d22\u8edf\u9ad4\u3002<\/p>\n\n\n\n

\u53e6\u5916\uff0c\u57289\u670819\u65e5\u8207\u53f0\u7063\u67d0\u4e0a\u5e02\u92fc\u9435\u696d\u8005\u540c\u6a23\u88abHive\u516c\u5e03\u8cc7\u6599\u7684\u53d7\u5bb3\u8005\uff0c\u9084\u5305\u542b\u4e00\u500b\u5728\u7f8e\u570b\u897f\u96c5\u5716\u540d\u70baFareStart\u7684\u975e\u71df\u5229\u6027\u7d44\u7e54\uff0c\u8a72\u7d44\u7e54\u4e3b\u8981\u70ba\u5f31\u52e2\u7fa4\u9ad4\u63d0\u4f9b\u9910\u98f2\u696d\u8077\u696d\u57f9\u8a13;\u53e6\u4e00\u500b\u5247\u662f\u4f4d\u65bc\u5a01\u65af\u5eb7\u8f9b\u5dde\u7684\u8ced\u5834\u540d\u70baHo-Chunk Gaming\uff0c\u53ef\u898bHive\u5728\u653b\u64ca\u7522\u696d\u7684\u8da8\u52e2\u958b\u59cb\u6709\u6240\u4e0d\u540c\u3002<\/p>\n\n\n\n

\u6709\u95dcHive\u52d2\u7d22\u8edf\u9ad4\u7684\u5165\u4fb5\u6307\u6a19(Indicator of compromise -IOCs):<\/p>\n\n\n\n

Hive Tor Domain:<\/p>\n\n\n\n

http:\/\/hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion<\/p>\n\n\n\n

Winlo.exe<\/p>\n\n\n\n

MD5 b5045d802394f4560280a7404af69263<\/p>\n\n\n\n

SHA256 321d0c4f1bbb44c53cd02186107a18b7a44c840a9a5f0a78bdac06868136b72c<\/p>\n\n\n\n

File Path Observed C:\\Windows\\SysWOW64\\winlo.exe<\/p>\n\n\n\n

Description Drops 7zG.exe<\/p>\n\n\n\n

7zG.exe<\/p>\n\n\n\n

MD5 04FB3AE7F05C8BC333125972BA907398<\/p>\n\n\n\n

Description This is a legitimate 7zip, version 19.0.0<\/p>\n\n\n\n

Drops Winlo_dump_64_SCY.exe<\/p>\n\n\n\n

Winlo_dump_64_SCY.exe<\/p>\n\n\n\n

MD5 BEE9BA70F36FF250B31A6FDF7FA8AFEB<\/p>\n\n\n\n

Description Encrypts files with *.key.* extension<\/p>\n\n\n\n

Drops HOW_TO_DECRYPT.txt<\/p>\n\n\n\n

HOW_TO_DECRYPT.txt<\/p>\n\n\n\n

Description<\/p>\n\n\n\n

Stops and disables Windows Defender<\/p>\n\n\n\n

Deletes all Windows Defender definitions<\/p>\n\n\n\n

Removes context menu for Windows Defender<\/p>\n\n\n\n

Stops the following services and disables them from restart<\/p>\n\n\n\n

 LanmanWorkstation<\/p>\n\n\n\n

 SamSs<\/p>\n\n\n\n

 SDRSVC<\/p>\n\n\n\n

 SstpSVc<\/p>\n\n\n\n

 UI0Detect<\/p>\n\n\n\n

 Vmicvss<\/p>\n\n\n\n

 Vmss<\/p>\n\n\n\n

 VSS<\/p>\n\n\n\n

 Wbengine<\/p>\n\n\n\n

 Unistoresvc<\/p>\n\n\n\n

Attempts to delete Volume Shadow Copies (vssadmin and wmic)<\/p>\n\n\n\n

Deletes Windows Event Logs -> System, Security, Application<\/p>\n\n\n\n

and powershell<\/p>\n\n\n\n

Uses notepad++ to create key file<\/p>\n\n\n\n

Changes bootup to ignore errors and not attempt recovery<\/p>\n\n\n\n

Drops PowerShell script<\/p>\n\n\n\n

<\/p>\n","protected":false},"excerpt":{"rendered":"

\u9996\u898bHive\u52d2\u7d22\u8edf\u9ad4\u5165\u4fb5\u53f0\u7063\uff0c\u5728Hive\u7684\u63ed\u79d8\u7db2\u7ad9Hive leaks\u4e0a\u767c\u73fe\u570b\u5167\u67d0\u77e5\u540d\u4e0a\u5e02\u92fc\u9435\u516c\u53f8\u5df2\u88abHive READ MORE<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[182],"class_list":["post-1391","post","type-post","status-publish","format-standard","hentry","category-6","tag-hive"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/blog.billows.com.tw\/index.php?rest_route=\/wp\/v2\/posts\/1391","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.billows.com.tw\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.billows.com.tw\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.billows.com.tw\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.billows.com.tw\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1391"}],"version-history":[{"count":2,"href":"https:\/\/blog.billows.com.tw\/index.php?rest_route=\/wp\/v2\/posts\/1391\/revisions"}],"predecessor-version":[{"id":1496,"href":"https:\/\/blog.billows.com.tw\/index.php?rest_route=\/wp\/v2\/posts\/1391\/revisions\/1496"}],"wp:attachment":[{"href":"https:\/\/blog.billows.com.tw\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1391"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.billows.com.tw\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1391"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.billows.com.tw\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1391"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}