Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
17-07-2024 03:47
General
-
Target
5158c5c17862225a86c8a4f36f054ae2_JaffaCakes118.xls
-
Size
428KB
-
MD5
5158c5c17862225a86c8a4f36f054ae2
-
SHA1
6da27200f473f8c55bb125f68314eecb2219c3dd
-
SHA256
b29691ac40b8bbb12b13e84641ad20583d1387ca356850aa7b5e76b0f6c76806
-
SHA512
c006f8ce77ef7dc150f137bb876a31e8f62f58e8337f487bab17752aa9eea95070e78b791488f36a2d152a871533a8bb9ee601f0053d1a2256d9e3cec3e7fe75
-
SSDEEP
6144:LxEtjPOtioVjDGUU1qfDlavx+W2QnAHBM:B
Malware Config
Signatures
-
CrimsonRAT main payload 1 IoCs
-
CrimsonRat
Crimson RAT is a malware linked to a Pakistani-linked threat actor.
-
Executes dropped EXE 1 IoCs
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of SetWindowsHookEx 24 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\5158c5c17862225a86c8a4f36f054ae2_JaffaCakes118.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Media-List\tbvrarthsa.exeC:\ProgramData\Media-List\tbvrarthsa.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
9.6MB
MD56d5e033651ae6371b8c8a44b269101b2
SHA11d069acd9f69a01a1001e3df37abb55981cf31ef
SHA2569acf62d22e93d6ea68b8d04a174fcd0c4e53d0f14fe1e7fadfcef4dfcc57f480
SHA512fbeef908cb2a1ad2b8d50ad41215e57afcd31707d165e4f6fa0362a8b5df67bd84eb70d98582f20d9b25cf40d26346084b647bbe56304e1631a60e76b98ff54b
-
Filesize
56KB
MD5d2c407c07cb5dc103cd112804455c0de
SHA1231d5808d31e04770c1850bb81df49ff877c1a2d
SHA256b4412a3806d135d58b9c8ef92947369457ca9b5e492aa02cf2d7540db39dd11b
SHA51276a3e86d29956c619b8ca3966c1f234bebde3e7adedbd1ad0fc4e4e32d2e7cd06c207f8680a7454102c6f478333f91a3a8ba6f203bbc31d05db7c9a3f065b0eb
-
Filesize
1KB
MD54e7c14aac2d3c954fbafd722c00ceafb
SHA175fe7d6fe7b46ae0d30594943e241ea3c05c26f3
SHA256b772ae57578b9b8a5d9ef975dff1a625ba54d15e39e44fc6eb8d80a0eceece5d
SHA512caa9b3e92e1a27e9c06bc18fd6d6f9dff220295de394e531e4a6bdcd23f4dc7d25e0b1e08c05c73f8663656f56ef33a12be607133341c2454af25bc6a7789cc0
-
Filesize
2.0MB
-
Filesize
32KB
-
Filesize
624KB
-
Filesize
2.0MB
-
Filesize
4.8MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB