Overview

overview

10

Static

static

hanta_2_0.exe

windows7_x64

8

hanta_2_0.exe

windows10_x64

10

Resubmissions

07-05-2021 13:00

210507-d762x9qcd6 10

07-05-2021 12:37

210507-zy4zqd3wc6 8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    hanta_2_0.exe

  • Size

    780KB

  • Sample

    210507-d762x9qcd6

  • MD5

    d33013cb6b28255069fcfea0575f49e9

  • SHA1

    fd4a4a0ad4e15d2c6a0d9b8bbe7dcde95bada378

  • SHA256

    5178fb0c885be51a83a0c53f56e86564548e65080913940eac96d9562270c299

  • SHA512

    63aca05c9dcfd89219da86cccd196b15cc6afdc22f64dde189fcea95d8c116fd0194d930568760e39899ee2a4b3893b3868a5df563e2573f7840c2531d416d63

Score
10/10
evasionpersistenceransomware

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\how_to_recover.html

Ransom Note
HANTA VIRUS WHAT HAPPENED WITH MY COMPUTER? All Files on your system has been encrypted with HANTA Virus. Nobody will be able to decrypt ANY of your files without our decryption service. Dont waste your time. CAN I RECOVER MY FILES? You will be able to recover your files only after you send amount$ in BTC to this BTC wallet: 1HYpnNyAERfmC5bnueGs7E3qDgMAxRiLGC or contact with us by email: hanta@420blaze.it Your system indetification: 89bbad60-16d5-41c2-ad8d-716f4ac5f4c2 Your personal key: -----BEGIN PUBLIC KEY----- -----END PUBLIC KEY----- Any antivirus sortware can corrupt files, if you want save back your files, turn off antivirus, it can delete our application
Emails

hanta@420blaze.it

Wallets

1HYpnNyAERfmC5bnueGs7E3qDgMAxRiLGC

Targets

    • Target

      hanta_2_0.exe

    • Size

      780KB

    • MD5

      d33013cb6b28255069fcfea0575f49e9

    • SHA1

      fd4a4a0ad4e15d2c6a0d9b8bbe7dcde95bada378

    • SHA256

      5178fb0c885be51a83a0c53f56e86564548e65080913940eac96d9562270c299

    • SHA512

      63aca05c9dcfd89219da86cccd196b15cc6afdc22f64dde189fcea95d8c116fd0194d930568760e39899ee2a4b3893b3868a5df563e2573f7840c2531d416d63

    Score
    10/10
    evasionpersistenceransomware

    • Disables Task Manager via registry modification

      evasion

    • Drops startup file

    • Adds Run key to start application

      persistence

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

3
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Defacement

1
T1491

Tasks