Ransomware Integrated
Decryption Tool User Manual- Hive Version1 to Version4 –June 2022- 1 -Directions for Using Decryption ToolPrecautions : Make sure to delete malicious code from the system first. If not, thesystem can be reinfected even if the infected file is recovered.
## Due to the cryptographic nature of Hive ransomware, it is difficult to recover 100%.
## KISA is not responsible for any problems caused by misuse.
## As the integrated decryption tool operates continuously, it is impossible torecover files if you exit the program in the middle.

The integrated decryption tool can decrypt Hive ransomware version 1 to 4.
However, in the version 2, it is possible to decrypt only if the extension of theinfected file is ‘.w2tnk’, ‘.uj1ps’.
1. Run the integrated decryption tool
WhenHive

Ransomware

Integrated

Decryption

Tool.exeisrunwithadministrator privileges, a Command Prompt(CMD) window appears.

Then, 4 folders are created in the path where the decryption tool is located. If
the encryption key file encrypted by the ransomware attacker, the infected file,the original file, and the file to be decryted are copied to the created folder,preparation for file decryption is completed.
Folder name

Copy to0_Encrypted_keyfile⇨Encryption key file encrypted by attacker

1_infected_files⇨Infected file2_original_files⇨

The original file of the infected file3_recovery_target_files⇨File to be decrypted

Hive Ransomware Integrated Decryption Tool User Manual- 1 -2. Check the version
For the Hive ransomware version, check the file extension and size of theencryption key encrypted by the ransomware attacker created on the C drive
when infected. However, in the version1, if the execution program is not run
with administrator privileges, an encrypted encryption key is created in thevirtualization folder. For the virtualization folder, refer to the details in the tableof contents of ‘3.1.1. Version1’.
VersionFile name1

random4

File size.hive

about 10MB.w2tnk

23

File extension

string.uj1psrandom string
random string

about 10MB
about 3KB,
100KB, 1MB
about 3MB

ExampleJub3Ee9tNMK1Wy0PRwuVTw.key.hive
Ns9SQ_476LclOK71vDYbAwrFKbt.key.w2tnk
wMeaAeiQD-vkcgjVMdenTtLGAST.key.uj1ps
xDKszTbfp3gyp7ixGWIWuZp5iS0B.key.fayg2
VICqe_MNCP-TubaUvhZ4IU5f1rqr.key.bvddx

After copying the encrypted encryption key to the 0_Encrypted_keyfile folder,
enter the Enter key in the previous window to check the Hive ransomware
version and see the result.

Hive Ransomware Integrated Decryption Tool User Manual- 2 -3. Collect original files
3.1. How to collect original files by version
To use the Hive ransomware integrated decryption tool, the infected file andthe original file of the infected file are needed. From version 1 to version 4, themethod of collecting original files is basically the same. However, in version 1, if
the ransomware execution program is not run with administrator privileges, theoriginal file must be collected in another way.
3.1.1. Version1
Whether the Hive ransomware version 1 execution program is run withadministrator

privileges

canbechecked

through thelocationofthefile

encryption key encrypted by the attacker. The encrypted file encryption key exists
in the root directory(C drive) if it is run with administrator privileges,

otherwisein the virtualization folder (C:\Users\<User_name>\AppData\Local\VirtualStore). The
file name is ‘random string.key.hive’, and the file size is about 10MB.
Whether to run withadministartor privileges

Encrypted file encryption key location

Run withadministartor privileges(C drive)

Not run withadministrator privileges(VirtualStore)

Hive Ransomware Integrated Decryption Tool User Manual- 3 -① When run with administrator privileges
When the Hive ransomware is run with administrator privileges, theinfected file is not created in the Virtualization folder(VirtualStore), but theinfected file is created in the 'Program Files', 'Program Files (x86)', and'ProgramData' folder of the C drive and the original file of the corresponding
file is deleted.
In this case, reinstall the same version of the program installed on theinfected PC to collect the original files. When the program is reinstalled,various formats of files such as library files of '.lib', '.dll' format, photo filesof '.jpeg', '.png', format are created in installation paths such as "Program
Files" and "Program Files" (x86). If the process of comparing the file with theinfected file is repeated, a large amount of original files can be collected.
In addition, there is also a method to collect original files by comparing
files sent and received via email, files on USB storage devices, and files
stored in cloud storage with infected files.
② When not run with administrator privileges
If the Hive ransomware is not run with administrator privileges, theinfected file is created in the Virtualization folder(VirtualStore). The original
file of the infected file is located in the ‘Program Files’, ‘Program Files(x86)’, ‘ProgramData’ folders of the C drive. The encryption key can bedecrypted using the original file and the infected file in the VirtualStore, andfiles such as infected document, photo, and video from which the original
file has been deleted can be decrypted.
3.1.2. Version2 to Version4
The method of collecting the original file of infected files of Hive ransomware
version 2 to version 4 is the same as the case ① When run with administrator
privileges of "3.1.1. Version 1". Thus, the original files of the infected files canbe collected using the corresponding method.

Hive Ransomware Integrated Decryption Tool User Manual- 4 -3.2. Conditions
When collecting the infected files and original files, three conditions have tobe met. If decryption is performed in a state where the conditions are notsatisfied, an error occurs or the decryption tool program is ended. Theconditions are as follows.
Infected files and original files① The name has to be the same.
② The total number has to be the same.
③ The version has to be the same.

Due to the cryptographic characteristics of Hive ransomware, the number offiles required for decryption is variable and difficult to quantify, so it isrecommended to refer to the description below.
In the version1, the number of files required for decryption varies according to
the total size of the files. If the total size of the files is 50 KB or less, 500 to
1,000 files are required, if the size is between 1 to 5 MB, more than 100 files
are required, and if the size is 25 MB, 30 to 50 files are required.
Version1

Total size of fileNumber of file required

50KB or less

500 to 1,000 files

1 to 5MB

more than 100 files

25MB

30 to 50 files

From version2 to version4, the number of files required for decryption varies
according to the size of individual file. If the extension of the infected file among
version 2 is ‘.w2tnk’, 500 to 1,000 files with a size of more than 86 KB arerequired, and for ‘.uj1ps’, 1,000 files with a size of more than 128 KB are requiredor 500 files with a size of more than 345 KB are required. For version 3, 100 files
with a size of more than 128 KB, and for version 4, at least 5 files with a size ofmore than 5 KB are required.
VersionSize of individual fileNumber of file required

more than 86KB

500 to 1,000 files

more than 128KB

1,000 files

more than 345KB

500 files

3

more than 128KB

100 files

4

more than 5KB

more than 5 files

w2tnk
2

uj1ps

Hive Ransomware Integrated Decryption Tool User Manual- 5 -The number of files required for decryption is inversely proportional to the total
size of files or the size of individual file depending on the version, so the usercan arbitrarily adjust the number of files required, and the decryption rate mayvary accordingly. However, if the number is too small, it is not possible toextract the values necessary for encryption key decryption, so this needs to be
noted(except version 4).
4. Perform decryption
After the collection of original files is completed, copy the infected file to the‘1_infected_files’ folder.

Hive Ransomware Integrated Decryption Tool User Manual- 6 -Then, copy the original file to the ‘2_original_files’ folder.

Hive Ransomware Integrated Decryption Tool User Manual- 7 -Finally, copy the files to be decrypted to the ‘3_recovery_target_files’ folder.

Hive Ransomware Integrated Decryption Tool User Manual- 8 -After copying the files required for decryption and the files to be decrypted toeach folder, press the Enter key in the previous window. The decryption tool
extracts the values necessary for decryption using the infected file and theoriginal file and recovers the encryption key. The time that it takes to recover
the encryption key may vary depending on the number of infected files andoriginal files.

Hive Ransomware Integrated Decryption Tool User Manual- 9 -When encryption key recovery is completed, decryption is performed targeting thefiles in the ‘3_recovery_target_files’ folder. For files that have been successfully
decrypted, the string 'Decrypted successfully!!' is displayed in the window.

Whendecryption

iscompleted,thedecryptedfileiscreatedinthe‘3_recovery_target_files’ folder. The string ‘dec_’ is added in front of the filename to distinguish it from an infected file.

Hive Ransomware Integrated Decryption Tool User Manual- 10 -What is Hive Ransomware?
Hive Ransomware is a ransomware discovered in June 2021 and mainly
attacks companies. It uses a variety of methods to penetrate the target
system and distribute ransomwares. Currently, various strains are continuously
being found, so special attention is needed to prevent infection.

Unauthorized reproduction or copying of the contents of this manual without thepermission of the Korea Internet & Security Agency is prohibited. Violation of this may bein conflict with the Copyright Act.

Ransomware Integrated Decryption Tool User Manual
June, 2022

Published by