5178fb0c885be51a83a0c53f56e86564548e65080913940eac96d9562270c299

Resubmissions

07-05-2021 13:00

210507-d762x9qcd6 10

07-05-2021 12:37

210507-zy4zqd3wc6 8

Analysis

max time kernel
14s
max time network
120s
platform
windows10_x64
resource
win10v20210410
submitted
07-05-2021 12:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

hanta_2_0.exe
Size

780KB
MD5

d33013cb6b28255069fcfea0575f49e9
SHA1

fd4a4a0ad4e15d2c6a0d9b8bbe7dcde95bada378
SHA256

5178fb0c885be51a83a0c53f56e86564548e65080913940eac96d9562270c299
SHA512

63aca05c9dcfd89219da86cccd196b15cc6afdc22f64dde189fcea95d8c116fd0194d930568760e39899ee2a4b3893b3868a5df563e2573f7840c2531d416d63

Score

8^/10

evasion persistence ransomware

Malware Config

Signatures

Disables Task Manager via registry modification
evasion
Drops startup file 1 IoCs

Processes:

hanta_2_0.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HANTA.exe hanta_2_0.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HANTA.exe	hanta_2_0.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

hanta_2_0.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\hanta_ransom = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\HANTA.exe\""	hanta_2_0.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

hanta_2_0.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wall.jpg"	hanta_2_0.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4244 3380 WerFault.exe hanta_2_0.exe

pid	pid_target	process	target process
4244	3380	WerFault.exe	hanta_2_0.exe

Modifies Control Panel 2 IoCs

evasion

Processes:

hanta_2_0.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Control Panel\Desktop\WallpaperStyle = "1"	hanta_2_0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Control Panel\Desktop\TileWallpaper = "0"	hanta_2_0.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

Processes:

hanta_2_0.exeWerFault.exe

pid	process
3380	hanta_2_0.exe
3380	hanta_2_0.exe
3380	hanta_2_0.exe
3380	hanta_2_0.exe
4244	WerFault.exe
4244	WerFault.exe
4244	WerFault.exe
4244	WerFault.exe
4244	WerFault.exe
4244	WerFault.exe
4244	WerFault.exe
4244	WerFault.exe
4244	WerFault.exe
4244	WerFault.exe
4244	WerFault.exe
4244	WerFault.exe
4244	WerFault.exe
4244	WerFault.exe
4244	WerFault.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

hanta_2_0.exeWerFault.exe

description	pid	process
Token: SeDebugPrivilege	3380	hanta_2_0.exe
Token: SeRestorePrivilege	4244	WerFault.exe
Token: SeBackupPrivilege	4244	WerFault.exe
Token: SeDebugPrivilege	4244	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\hanta_2_0.exe
"C:\Users\Admin\AppData\Local\Temp\hanta_2_0.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3380 -s 6252
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4244

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3380-114-0x00000000003D0000-0x00000000003D1000-memory.dmp

Filesize
4KB

Download
memory/3380-116-0x0000000000C30000-0x0000000000C31000-memory.dmp

Filesize
4KB

Download
memory/3380-117-0x0000000004D40000-0x0000000004DF5000-memory.dmp

Filesize
724KB

Download
memory/3380-118-0x0000000000C40000-0x0000000000C41000-memory.dmp

Filesize
4KB

Download
memory/3380-119-0x00000000026E0000-0x00000000026E1000-memory.dmp

Filesize
4KB

Download