Overview

overview

10

Static

static

hanta_2_0.exe

windows7_x64

8

hanta_2_0.exe

windows10_x64

10

Resubmissions

07/05/2021, 13:00

210507-d762x9qcd610

07/05/2021, 12:37

210507-zy4zqd3wc68

Analysis

  • max time kernel
    87s
  • max time network
    110s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    07/05/2021, 13:00

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    hanta_2_0.exe
  • Size 780KB
  • Sample210507-d762x9qcd6
  • SHA256 5178fb0c885be51a83a0c53f56e86564548e65080913940eac96d9562270c299
  • MD5 SHA1 SHA512
Score
10/10
evasionpersistenceransomware

Malware Config

Extracted

Path

  • C:\Users\Admin\Desktop\how_to_recover.html

Ransom Note
  • HANTA VIRUS WHAT HAPPENED WITH MY COMPUTER? All Files on your system has been encrypted with HANTA Virus. Nobody will be able to decrypt ANY of your files without our decryption service. Dont waste your time. CAN I RECOVER MY FILES? You will be able to recover your files only after you send amount$ in BTC to this BTC wallet: 1HYpnNyAERfmC5bnueGs7E3qDgMAxRiLGC or contact with us by email: [email protected] Your system indetification: 89bbad60-16d5-41c2-ad8d-716f4ac5f4c2 Your personal key: -----BEGIN PUBLIC KEY----- -----END PUBLIC KEY----- Any antivirus sortware can corrupt files, if you want save back your files, turn off antivirus, it can delete our application
Wallets

  • 1HYpnNyAERfmC5bnueGs7E3qDgMAxRiLGC

Signatures

  • Disables Task Manager via registry modification
    evasion
  • Drops startup file 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Windows directory 1 IoCs
  • Program crash 1 IoCs
  • Modifies Control Panel 2 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Runs regedit.exe 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 19 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 15 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\hanta_2_0.exe
    "C:\Users\Admin\AppData\Local\Temp\hanta_2_0.exe"
    1⤵
    • Drops startup file
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1824
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1824 -s 5632
      2⤵
      • Program crash
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4012
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:4336
  • C:\Windows\system32\browser_broker.exe
    C:\Windows\system32\browser_broker.exe -Embedding
    1⤵
    • Modifies Internet Explorer settings
    PID:4376
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    1⤵
    • Modifies registry class
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4608
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    PID:4680
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    1⤵
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    PID:4872
  • C:\Windows\system32\taskmgr.exe
    "C:\Windows\system32\taskmgr.exe" /4
    1⤵
      PID:5068
    • C:\Windows\regedit.exe
      "C:\Windows\regedit.exe"
      1⤵
      • Runs regedit.exe
      PID:2100
    • C:\Windows\system32\taskmgr.exe
      "C:\Windows\system32\taskmgr.exe" /4
      1⤵
        PID:1808

      Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            memory/1824-114-0x0000000000BF0000-0x0000000000BF1000-memory.dmp
            Download

            memory/1824-116-0x0000000002FE0000-0x0000000002FE1000-memory.dmp
            Download

            memory/1824-117-0x0000000005550000-0x0000000005605000-memory.dmp
            Download

            memory/1824-118-0x0000000002F40000-0x0000000002F41000-memory.dmp
            Download

            memory/1824-119-0x00000000057F0000-0x00000000057F1000-memory.dmp
            Download