Overview

overview

10

Static

static

hanta_2_0.exe

windows7_x64

8

hanta_2_0.exe

windows10_x64

10

Resubmissions

07-05-2021 13:00

210507-d762x9qcd6 10

07-05-2021 12:37

210507-zy4zqd3wc6 8

Analysis

  • max time kernel
    87s
  • max time network
    110s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    07-05-2021 13:00

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    hanta_2_0.exe

  • Size

    780KB

  • MD5

    d33013cb6b28255069fcfea0575f49e9

  • SHA1

    fd4a4a0ad4e15d2c6a0d9b8bbe7dcde95bada378

  • SHA256

    5178fb0c885be51a83a0c53f56e86564548e65080913940eac96d9562270c299

  • SHA512

    63aca05c9dcfd89219da86cccd196b15cc6afdc22f64dde189fcea95d8c116fd0194d930568760e39899ee2a4b3893b3868a5df563e2573f7840c2531d416d63

Score
10/10
evasionpersistenceransomware

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\how_to_recover.html

Ransom Note
HANTA VIRUS WHAT HAPPENED WITH MY COMPUTER? All Files on your system has been encrypted with HANTA Virus. Nobody will be able to decrypt ANY of your files without our decryption service. Dont waste your time. CAN I RECOVER MY FILES? You will be able to recover your files only after you send amount$ in BTC to this BTC wallet: 1HYpnNyAERfmC5bnueGs7E3qDgMAxRiLGC or contact with us by email: hanta@420blaze.it Your system indetification: 89bbad60-16d5-41c2-ad8d-716f4ac5f4c2 Your personal key: -----BEGIN PUBLIC KEY----- -----END PUBLIC KEY----- Any antivirus sortware can corrupt files, if you want save back your files, turn off antivirus, it can delete our application
Emails

hanta@420blaze.it

Wallets

1HYpnNyAERfmC5bnueGs7E3qDgMAxRiLGC

Signatures

  • Disables Task Manager via registry modification
    evasion
  • Drops startup file 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Windows directory 1 IoCs
  • Program crash 1 IoCs
  • Modifies Control Panel 2 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Runs regedit.exe 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 19 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 15 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\hanta_2_0.exe
    "C:\Users\Admin\AppData\Local\Temp\hanta_2_0.exe"
    1⤵
    • Drops startup file
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1824
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1824 -s 5632
      2⤵
      • Program crash
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4012
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:4336
  • C:\Windows\system32\browser_broker.exe
    C:\Windows\system32\browser_broker.exe -Embedding
    1⤵
    • Modifies Internet Explorer settings
    PID:4376
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    1⤵
    • Modifies registry class
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4608
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    PID:4680
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    1⤵
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    PID:4872
  • C:\Windows\system32\taskmgr.exe
    "C:\Windows\system32\taskmgr.exe" /4
    1⤵
      PID:5068
    • C:\Windows\regedit.exe
      "C:\Windows\regedit.exe"
      1⤵
      • Runs regedit.exe
      PID:2100
    • C:\Windows\system32\taskmgr.exe
      "C:\Windows\system32\taskmgr.exe" /4
      1⤵
        PID:1808

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Initial Access

      Execution

      Persistence

      Registry Run Keys / Startup Folder

      1
      T1060

      Privilege Escalation

      Defense Evasion

      Modify Registry

      3
      T1112

      Credential Access

      Discovery

      Lateral Movement

      Collection

      Exfiltration

      Command and Control

      Impact

      Defacement

      1
      T1491

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HANTA.exe
        MD5

        d33013cb6b28255069fcfea0575f49e9

        SHA1

        fd4a4a0ad4e15d2c6a0d9b8bbe7dcde95bada378

        SHA256

        5178fb0c885be51a83a0c53f56e86564548e65080913940eac96d9562270c299

        SHA512

        63aca05c9dcfd89219da86cccd196b15cc6afdc22f64dde189fcea95d8c116fd0194d930568760e39899ee2a4b3893b3868a5df563e2573f7840c2531d416d63

        Download Submit
      • C:\Users\Admin\Desktop\how_to_recover.html
        MD5

        cf753fde1c5feee189e026496628252f

        SHA1

        c8061a05626e4e4de54ea5327ba99f8481739167

        SHA256

        b54acddaf772280966a88df90e0826eb874324086588f83758bcdcab716434bc

        SHA512

        cc847df08382fc594cd86c2572693bbeac2fe156535fbe97425b062945eeb0ff57ef54c1d82ed7283646ad14c5e17f3147452646a6de42d00f7c6f16f028fd84

        Download Submit
      • memory/1824-114-0x0000000000BF0000-0x0000000000BF1000-memory.dmp
        Filesize

        4KB

        Download
      • memory/1824-116-0x0000000002FE0000-0x0000000002FE1000-memory.dmp
        Filesize

        4KB

        Download
      • memory/1824-117-0x0000000005550000-0x0000000005605000-memory.dmp
        Filesize

        724KB

        Download
      • memory/1824-118-0x0000000002F40000-0x0000000002F41000-memory.dmp
        Filesize

        4KB

        Download
      • memory/1824-119-0x00000000057F0000-0x00000000057F1000-memory.dmp
        Filesize

        4KB

        Download