Sheba Bakut

[Sheba Bakut @ShebaBakut]

@MrCharlesky Interested

[Sheba Bakut @ShebaBakut]

@zillionokoye Interested

[Sheba Bakut @ShebaBakut]

@JobFound5 Interested

[Sheba Bakut @ShebaBakut]

@zillionokoye I'm interested

[Sheba Bakut @ShebaBakut]

@zillionokoye interested

[Sheba Bakut @ShebaBakut]

@JobFound5 interested

[Sheba Bakut @ShebaBakut]

@MrCharlesky Up and Available

[Sheba Bakut @ShebaBakut]

@BenoHr80463 I am interested

[Sheba Bakut @ShebaBakut]

Full report covers: → Complete MITRE ATT&CK mapping (12 techniques) → YARA + KQL detection rules → Containment commands → Hardening priorities If you do malware analysis, share this. The sandbox confidence gap is real and it gets people hurt. https://t.co/EzhzPPbALf

[Sheba Bakut @ShebaBakut]

I just published Dissecting Hive Ransomware: A Full SOC Lab Walkthrough https://t.co/EzhzPPbALf

[Sheba Bakut @ShebaBakut]

This is the most important lesson from the whole lab: AI sandbox summaries are not ground truth. They are a starting point. Time-delayed payloads exist precisely to beat automated analysis windows. Always inspect raw IOC JSON — especially when the VirusTotal score says 53/61.

[Sheba Bakut @ShebaBakut]

Then we ran it through https://t.co/Ggj2Nyuf55. AI summary: "No malicious behaviour detected. No signs of staged payloads." Meanwhile, the raw IOC JSON showed .hive files being dropped across the filesystem. What happened? hive.bat ran timeout.exe in a loop. Sandbox timed out

[Sheba Bakut @ShebaBakut]

Wireshark captured: nothing suspicious. No C2 beacons. No DNS queries to shady domains. No encrypted tunnels. This ransomware generates keys locally and encrypts completely offline. Firewalls won't save you. It runs fine in air-gapped environments.

[Sheba Bakut @ShebaBakut]

Dynamic analysis (ProcMon) told a different story. hive.exe spawned 3 child processes, injected code into winmm.dll using PAGE_EXECUTE memory mapping, loaded bcryptprimitives.dll, queried crypto registry keys, then dropped .hive encrypted files and a HOW_TO_ ransom note.

[Sheba Bakut @ShebaBakut]

Static analysis with DiE + PEStudio showed: → UPX v3.96 packer (LZMA) → Section entropy: 7.99997 out of 8.0 → Import table: just 4 functions — everything else resolved at runtime → Debug symbols stripped → Self-modifying sections This binary was built to be invisible.

[Sheba Bakut @ShebaBakut]

The sample arrived as "Final Project.7z" a classic spearphishing delivery. Inside: hive.exe, a UPX-packed, Golang-compiled ransomware binary. VirusTotal score: 53/61. First red flag was visible before we even ran it.

[Sheba Bakut @ShebaBakut]

@zillionokoye @MrCharlesky Interested

[Sheba Bakut @ShebaBakut]

@MrCharlesky I'm Interested

[Sheba Bakut @ShebaBakut]

@cyb3rshi3ld 🛡️

[Sheba Bakut @ShebaBakut]

The attack ran in 4 phases: enumeration → brute force → successful access → privilege escalation.

svc_backup failed repeatedly, then logged in successfully at 10:10:48. guest got elevated privileges the same second as a failed logon.

[Sheba Bakut @ShebaBakut]

Analyzed 1,001 Windows auth logs in Splunk and found an active credential attack in progress.

Full technical breakdown on Medium → [https://t.co/4nWTCxKxwO ]