Analysis

  • max time kernel
    152s
  • max time network
    168s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    21-01-2022 23:00

General

  • Target

    BHC-PR/British High Commission Urdu Press Release - GREAT Debate Islamabad 2020.exe

  • Size

    269KB

  • MD5

    336848d6de6faa8e8d737570046b0321

  • SHA1

    84c33015a30fcfe38faa294820782c1f2f68da06

  • SHA256

    e7dbf1eacfbd73576b0e410099898e4c7e2d51d76fe3095314dee1b54860bf4f

  • SHA512

    85196ede8187b9f8711547fc1fc5f497edd8c9083d29b23ce2d2ac18a83fdc81cde2a38e9fb98de89e927cc016c04db9457dff14255679b5ed047a18d7334cfe

Score
10/10

Malware Config

Signatures

  • CrimsonRAT Main Payload 2 IoCs
  • CrimsonRat

    Crimson RAT is a malware linked to a Pakistani-linked threat actor.

  • Executes dropped EXE 1 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\BHC-PR\British High Commission Urdu Press Release - GREAT Debate Islamabad 2020.exe
    "C:\Users\Admin\AppData\Local\Temp\BHC-PR\British High Commission Urdu Press Release - GREAT Debate Islamabad 2020.exe"
    1⤵
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:892
    • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\Documents\British High Commission Urdu Press Release - GREAT Debate Islamabad 2020-03-.docx"
      2⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:332
      • C:\Windows\splwow64.exe
        C:\Windows\splwow64.exe 12288
        3⤵
          PID:1220
      • C:\ProgramData\Hanthavra\rnthiavesa.exe
        "C:\ProgramData\Hanthavra\rnthiavesa.exe"
        2⤵
        • Executes dropped EXE
        PID:1544

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\ProgramData\Hanthavra\rnthiavesa.exe

      MD5

      d5783c974f54f8eb9ba0eb4396b04187

      SHA1

      f246f1db61947165aa25a7d7f04e1b231a867b99

      SHA256

      e38ff03d54d40f4e10292d7cbd614f26f3af13d01ded95dc7c363b317a5d6dd4

      SHA512

      9baf895b24696d6b760925a34d1eb5ae6b6599601d3ed77d8cbae425bb57a1692c233ef6f67acf83332532ea39a6752e39375b7a0bfb4ab19e8a06e06fc86ce9

    • C:\ProgramData\Hanthavra\rnthiavesa.exe

      MD5

      d5783c974f54f8eb9ba0eb4396b04187

      SHA1

      f246f1db61947165aa25a7d7f04e1b231a867b99

      SHA256

      e38ff03d54d40f4e10292d7cbd614f26f3af13d01ded95dc7c363b317a5d6dd4

      SHA512

      9baf895b24696d6b760925a34d1eb5ae6b6599601d3ed77d8cbae425bb57a1692c233ef6f67acf83332532ea39a6752e39375b7a0bfb4ab19e8a06e06fc86ce9

    • C:\Users\Admin\Documents\British High Commission Urdu Press Release - GREAT Debate Islamabad 2020-03-.docx

      MD5

      498aba93d84770619caa1029cde79bf7

      SHA1

      63c5f8f5ac49040d8a2d19e41a0c499076881112

      SHA256

      994dddf45424b2ec72cf186de56f9190a643718bc5c3006465b1bd958a6eb5e8

      SHA512

      1de8c8e20cc4a88da9441339454a9370d4453853dc3969a02ec8f2477596419ebe2e06ba6b39dacb05eeb85b0ed19e4e93473af31b4bd97adf2bbd53f4c823e7

    • memory/332-63-0x0000000070821000-0x0000000070823000-memory.dmp

      Filesize

      8KB

    • memory/332-57-0x0000000072DA1000-0x0000000072DA4000-memory.dmp

      Filesize

      12KB

    • memory/332-64-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/332-65-0x0000000076451000-0x0000000076453000-memory.dmp

      Filesize

      8KB

    • memory/332-68-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/892-56-0x00000000020C6000-0x00000000020E5000-memory.dmp

      Filesize

      124KB

    • memory/892-55-0x00000000020C0000-0x00000000020C2000-memory.dmp

      Filesize

      8KB

    • memory/892-54-0x000007FEF2CF0000-0x000007FEF3D86000-memory.dmp

      Filesize

      16.6MB

    • memory/1220-67-0x000007FEFC2B1000-0x000007FEFC2B3000-memory.dmp

      Filesize

      8KB

    • memory/1544-60-0x000007FEF2CF0000-0x000007FEF3D86000-memory.dmp

      Filesize

      16.6MB

    • memory/1544-61-0x0000000000AF0000-0x0000000000AF2000-memory.dmp

      Filesize

      8KB

    • memory/1544-62-0x0000000000AF6000-0x0000000000B15000-memory.dmp

      Filesize

      124KB