Analysis
- max time kernel
149s - max time network
130s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
11/10/2026, 17:32
General
- Target 2756b78e9d72257067b63018ed3de4524812c60c72211288698ec78dcfc08921.exe
- Size 780KB
- Sample261011-v4fdlsbv7x
- SHA256 2756b78e9d72257067b63018ed3de4524812c60c72211288698ec78dcfc08921
Malware Config
Extracted
-
C:\Users\Admin\Desktop\how_to_recover.html
-
hanta
- HANTA VIRUS WHAT HAPPENED WITH MY COMPUTER? All Files on your system has been encrypted with HANTA Virus. Nobody will be able to decrypt ANY of your files without our decryption service. Dont waste your time. CAN I RECOVER MY FILES? You will be able to recover your files only after you send amount$ in BTC to this BTC wallet: 1HYpnNyAERfmC5bnueGs7E3qDgMAxRiLGC or contact with us by email: [email protected] Your system indetification: c1752df3-9308-43f3-b3f4-0cd87d6e3e1f Your personal key: -----BEGIN PUBLIC KEY----- -----END PUBLIC KEY----- Any antivirus sortware can corrupt files, if you want save back your files, turn off antivirus, it can delete our application
-
1HYpnNyAERfmC5bnueGs7E3qDgMAxRiLGC
Signatures
- Family: HANTA Ransomware
Ransomware family first detected in March 2021 with multiple minor variants observed.
- Disables Task Manager via registry modification
- Creates a file in the Startup directory 1 TTPs 1 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
- Executes dropped EXE 1 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Sets desktop wallpaper using registry 2 TTPs 2 IoCs
- Program crash 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies Control Panel 4 IoCs
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2756b78e9d72257067b63018ed3de4524812c60c72211288698ec78dcfc08921.exe"C:\Users\Admin\AppData\Local\Temp\2756b78e9d72257067b63018ed3de4524812c60c72211288698ec78dcfc08921.exe"1⤵
- Creates a file in the Startup directory
- Adds Run key to start application
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1104 -s 114282⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1104 -ip 11041⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HANTA.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HANTA.exe"1⤵
- Executes dropped EXE
- Adds Run key to start application
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1492 -s 60202⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1492 -ip 14921⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
wall.jpg
HANTA.exe
how_to_recover.html
memory/1104-0-0x0000000000570000-0x000000000063C000-memory.dmp
memory/1104-1-0x0000000001060000-0x0000000001066000-memory.dmp
memory/1104-2-0x0000000005180000-0x0000000005190000-memory.dmp
memory/1104-3-0x00000000050C0000-0x000000000517E000-memory.dmp
memory/1104-4-0x0000000001070000-0x0000000001076000-memory.dmp
memory/1492-10-0x0000000002B70000-0x0000000002B80000-memory.dmp