Analysis

  • max time kernel
    127s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    21-01-2022 23:00

General

  • Target

    BHC-PR/BHC PR - British Airways Restarts Flights to Pakistan.exe

  • Size

    265KB

  • MD5

    aa2081abe728ee1cc658dd0362bc464f

  • SHA1

    811cc8f3095fee20a1c6f5041c243fbf39ae8fcf

  • SHA256

    a22f6dc3eb0001c2be76d261721a1c1f419e15f6b5bfff95c5b8a5f633ce1956

  • SHA512

    621883b9cc461656f9f70e3f4dcd26f5827a007cc194d535bba414f5f8b406ee0f2edd6269617a2a947dfb60ea2c0176e840798802c6c8fb9ffb9a55c511f5f1

Score
10/10

Malware Config

Signatures

  • CrimsonRAT Main Payload 2 IoCs
  • CrimsonRat

    Crimson RAT is a malware linked to a Pakistani-linked threat actor.

  • Executes dropped EXE 1 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\BHC-PR\BHC PR - British Airways Restarts Flights to Pakistan.exe
    "C:\Users\Admin\AppData\Local\Temp\BHC-PR\BHC PR - British Airways Restarts Flights to Pakistan.exe"
    1⤵
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:1308
    • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\Documents\BHC PR - British Airways Restarts Flights to Pakistan-03-.docx"
      2⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1160
      • C:\Windows\splwow64.exe
        C:\Windows\splwow64.exe 12288
        3⤵
          PID:1056
      • C:\ProgramData\Hanthavra\rnthiavesa.exe
        "C:\ProgramData\Hanthavra\rnthiavesa.exe"
        2⤵
        • Executes dropped EXE
        PID:816

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\ProgramData\Hanthavra\rnthiavesa.exe

      MD5

      d5783c974f54f8eb9ba0eb4396b04187

      SHA1

      f246f1db61947165aa25a7d7f04e1b231a867b99

      SHA256

      e38ff03d54d40f4e10292d7cbd614f26f3af13d01ded95dc7c363b317a5d6dd4

      SHA512

      9baf895b24696d6b760925a34d1eb5ae6b6599601d3ed77d8cbae425bb57a1692c233ef6f67acf83332532ea39a6752e39375b7a0bfb4ab19e8a06e06fc86ce9

    • C:\ProgramData\Hanthavra\rnthiavesa.exe

      MD5

      d5783c974f54f8eb9ba0eb4396b04187

      SHA1

      f246f1db61947165aa25a7d7f04e1b231a867b99

      SHA256

      e38ff03d54d40f4e10292d7cbd614f26f3af13d01ded95dc7c363b317a5d6dd4

      SHA512

      9baf895b24696d6b760925a34d1eb5ae6b6599601d3ed77d8cbae425bb57a1692c233ef6f67acf83332532ea39a6752e39375b7a0bfb4ab19e8a06e06fc86ce9

    • C:\Users\Admin\Documents\BHC PR - British Airways Restarts Flights to Pakistan-03-.docx

      MD5

      19eeb247e5e81e212fa64aa19c142014

      SHA1

      1a8ce7d52d5e866bda957f659e29cea50a2ae849

      SHA256

      3220fb8cee40d09ac6769e6ebb8f86b8ed54ff10eebf5ba01ab08d8431d98c80

      SHA512

      8da9bd1fb3493bc4d624188b82772d643132eb35741cf39e7edf561f0e8984e8510f868658f2e1e27a3fa9195f6cd80a19934bc3fcdd6d5a6df5535e7987b425

    • memory/816-63-0x0000000000B86000-0x0000000000BA5000-memory.dmp

      Filesize

      124KB

    • memory/816-61-0x000007FEF2BD0000-0x000007FEF3C66000-memory.dmp

      Filesize

      16.6MB

    • memory/816-62-0x0000000000B80000-0x0000000000B82000-memory.dmp

      Filesize

      8KB

    • memory/1056-67-0x000007FEFC261000-0x000007FEFC263000-memory.dmp

      Filesize

      8KB

    • memory/1160-58-0x00000000707D1000-0x00000000707D3000-memory.dmp

      Filesize

      8KB

    • memory/1160-57-0x0000000072D51000-0x0000000072D54000-memory.dmp

      Filesize

      12KB

    • memory/1160-64-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/1160-65-0x0000000075CE1000-0x0000000075CE3000-memory.dmp

      Filesize

      8KB

    • memory/1160-68-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/1308-56-0x0000000000360000-0x0000000000640000-memory.dmp

      Filesize

      2.9MB

    • memory/1308-54-0x0000000000360000-0x0000000000640000-memory.dmp

      Filesize

      2.9MB

    • memory/1308-55-0x000007FEF2BD0000-0x000007FEF3C66000-memory.dmp

      Filesize

      16.6MB