imminent | bf390af80de742815f82101b0694d401810c2c7fa165afbbcaba73f70439db8e

Analysis

max time kernel
150s
max time network
118s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
11-05-2024 17:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

35c82cd9f2b90bf84a83dfddd0da32fd_JaffaCakes118.exe
Size

598KB
MD5

35c82cd9f2b90bf84a83dfddd0da32fd
SHA1

97cf182a5b40a5fcf320ee92adee47eabc9c41a9
SHA256

bf390af80de742815f82101b0694d401810c2c7fa165afbbcaba73f70439db8e
SHA512

7805249c5b7ee474c9cbc2d684ebc220d939d210d095414117e55db416dc56c30f59ddba139290a92fbea91c98e3ce8289e262fe670a558725777fdfadd37a16
SSDEEP

12288:Pds3bdz0BKRBqb5y8wBQFZyQM19vkWiwcscqYoeIv91Cq2yBkczFfv:Vs3Jzb8grBQVts9D

Score

10^/10

imminent persistence spyware trojan

Malware Config

Signatures

Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
trojan spyware imminent

Deletes itself 1 IoCs

pid	Process
2596	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
2536	35c82cd9f2b90bf84a83dfddd0da32fd_jaffacakes118.exe
2620	35c82cd9f2b90bf84a83dfddd0da32fd_jaffacakes118.exe

Loads dropped DLL 2 IoCs

pid	Process
2896	35c82cd9f2b90bf84a83dfddd0da32fd_JaffaCakes118.exe
2536	35c82cd9f2b90bf84a83dfddd0da32fd_jaffacakes118.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Roaming\\\\.exe"	35c82cd9f2b90bf84a83dfddd0da32fd_jaffacakes118.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1848 set thread context of 2896	1848	35c82cd9f2b90bf84a83dfddd0da32fd_JaffaCakes118.exe	28
PID 2536 set thread context of 2620	2536	35c82cd9f2b90bf84a83dfddd0da32fd_jaffacakes118.exe	34

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch.new	35c82cd9f2b90bf84a83dfddd0da32fd_jaffacakes118.exe
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch.new	35c82cd9f2b90bf84a83dfddd0da32fd_jaffacakes118.exe
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch.new	35c82cd9f2b90bf84a83dfddd0da32fd_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch.new	35c82cd9f2b90bf84a83dfddd0da32fd_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1056	PING.EXE

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
1848	35c82cd9f2b90bf84a83dfddd0da32fd_JaffaCakes118.exe
2896	35c82cd9f2b90bf84a83dfddd0da32fd_JaffaCakes118.exe
2896	35c82cd9f2b90bf84a83dfddd0da32fd_JaffaCakes118.exe
2896	35c82cd9f2b90bf84a83dfddd0da32fd_JaffaCakes118.exe
2896	35c82cd9f2b90bf84a83dfddd0da32fd_JaffaCakes118.exe
2896	35c82cd9f2b90bf84a83dfddd0da32fd_JaffaCakes118.exe
2896	35c82cd9f2b90bf84a83dfddd0da32fd_JaffaCakes118.exe
2896	35c82cd9f2b90bf84a83dfddd0da32fd_JaffaCakes118.exe
2896	35c82cd9f2b90bf84a83dfddd0da32fd_JaffaCakes118.exe
2896	35c82cd9f2b90bf84a83dfddd0da32fd_JaffaCakes118.exe
2536	35c82cd9f2b90bf84a83dfddd0da32fd_jaffacakes118.exe
2620	35c82cd9f2b90bf84a83dfddd0da32fd_jaffacakes118.exe
2620	35c82cd9f2b90bf84a83dfddd0da32fd_jaffacakes118.exe
2620	35c82cd9f2b90bf84a83dfddd0da32fd_jaffacakes118.exe
2620	35c82cd9f2b90bf84a83dfddd0da32fd_jaffacakes118.exe
2620	35c82cd9f2b90bf84a83dfddd0da32fd_jaffacakes118.exe
2620	35c82cd9f2b90bf84a83dfddd0da32fd_jaffacakes118.exe
2620	35c82cd9f2b90bf84a83dfddd0da32fd_jaffacakes118.exe
2620	35c82cd9f2b90bf84a83dfddd0da32fd_jaffacakes118.exe
2620	35c82cd9f2b90bf84a83dfddd0da32fd_jaffacakes118.exe
2620	35c82cd9f2b90bf84a83dfddd0da32fd_jaffacakes118.exe
2620	35c82cd9f2b90bf84a83dfddd0da32fd_jaffacakes118.exe
2620	35c82cd9f2b90bf84a83dfddd0da32fd_jaffacakes118.exe
2620	35c82cd9f2b90bf84a83dfddd0da32fd_jaffacakes118.exe
2620	35c82cd9f2b90bf84a83dfddd0da32fd_jaffacakes118.exe
2620	35c82cd9f2b90bf84a83dfddd0da32fd_jaffacakes118.exe
2620	35c82cd9f2b90bf84a83dfddd0da32fd_jaffacakes118.exe
2620	35c82cd9f2b90bf84a83dfddd0da32fd_jaffacakes118.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2620	35c82cd9f2b90bf84a83dfddd0da32fd_jaffacakes118.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	1848	35c82cd9f2b90bf84a83dfddd0da32fd_JaffaCakes118.exe
Token: SeDebugPrivilege	2896	35c82cd9f2b90bf84a83dfddd0da32fd_JaffaCakes118.exe
Token: SeDebugPrivilege	2536	35c82cd9f2b90bf84a83dfddd0da32fd_jaffacakes118.exe
Token: SeDebugPrivilege	2620	35c82cd9f2b90bf84a83dfddd0da32fd_jaffacakes118.exe
Token: 33	2620	35c82cd9f2b90bf84a83dfddd0da32fd_jaffacakes118.exe
Token: SeIncBasePriorityPrivilege	2620	35c82cd9f2b90bf84a83dfddd0da32fd_jaffacakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2620	35c82cd9f2b90bf84a83dfddd0da32fd_jaffacakes118.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 1848 wrote to memory of 2896	1848	35c82cd9f2b90bf84a83dfddd0da32fd_JaffaCakes118.exe	28
PID 1848 wrote to memory of 2896	1848	35c82cd9f2b90bf84a83dfddd0da32fd_JaffaCakes118.exe	28
PID 1848 wrote to memory of 2896	1848	35c82cd9f2b90bf84a83dfddd0da32fd_JaffaCakes118.exe	28
PID 1848 wrote to memory of 2896	1848	35c82cd9f2b90bf84a83dfddd0da32fd_JaffaCakes118.exe	28
PID 1848 wrote to memory of 2896	1848	35c82cd9f2b90bf84a83dfddd0da32fd_JaffaCakes118.exe	28
PID 1848 wrote to memory of 2896	1848	35c82cd9f2b90bf84a83dfddd0da32fd_JaffaCakes118.exe	28
PID 1848 wrote to memory of 2896	1848	35c82cd9f2b90bf84a83dfddd0da32fd_JaffaCakes118.exe	28
PID 1848 wrote to memory of 2896	1848	35c82cd9f2b90bf84a83dfddd0da32fd_JaffaCakes118.exe	28
PID 1848 wrote to memory of 2896	1848	35c82cd9f2b90bf84a83dfddd0da32fd_JaffaCakes118.exe	28
PID 2896 wrote to memory of 1848	2896	35c82cd9f2b90bf84a83dfddd0da32fd_JaffaCakes118.exe	27
PID 2896 wrote to memory of 1848	2896	35c82cd9f2b90bf84a83dfddd0da32fd_JaffaCakes118.exe	27
PID 2896 wrote to memory of 1848	2896	35c82cd9f2b90bf84a83dfddd0da32fd_JaffaCakes118.exe	27
PID 2896 wrote to memory of 1848	2896	35c82cd9f2b90bf84a83dfddd0da32fd_JaffaCakes118.exe	27
PID 2896 wrote to memory of 1848	2896	35c82cd9f2b90bf84a83dfddd0da32fd_JaffaCakes118.exe	27
PID 2896 wrote to memory of 2536	2896	35c82cd9f2b90bf84a83dfddd0da32fd_JaffaCakes118.exe	30
PID 2896 wrote to memory of 2536	2896	35c82cd9f2b90bf84a83dfddd0da32fd_JaffaCakes118.exe	30
PID 2896 wrote to memory of 2536	2896	35c82cd9f2b90bf84a83dfddd0da32fd_JaffaCakes118.exe	30
PID 2896 wrote to memory of 2536	2896	35c82cd9f2b90bf84a83dfddd0da32fd_JaffaCakes118.exe	30
PID 2896 wrote to memory of 2596	2896	35c82cd9f2b90bf84a83dfddd0da32fd_JaffaCakes118.exe	31
PID 2896 wrote to memory of 2596	2896	35c82cd9f2b90bf84a83dfddd0da32fd_JaffaCakes118.exe	31
PID 2896 wrote to memory of 2596	2896	35c82cd9f2b90bf84a83dfddd0da32fd_JaffaCakes118.exe	31
PID 2896 wrote to memory of 2596	2896	35c82cd9f2b90bf84a83dfddd0da32fd_JaffaCakes118.exe	31
PID 2596 wrote to memory of 1056	2596	cmd.exe	33
PID 2596 wrote to memory of 1056	2596	cmd.exe	33
PID 2596 wrote to memory of 1056	2596	cmd.exe	33
PID 2596 wrote to memory of 1056	2596	cmd.exe	33
PID 2536 wrote to memory of 2620	2536	35c82cd9f2b90bf84a83dfddd0da32fd_jaffacakes118.exe	34
PID 2536 wrote to memory of 2620	2536	35c82cd9f2b90bf84a83dfddd0da32fd_jaffacakes118.exe	34
PID 2536 wrote to memory of 2620	2536	35c82cd9f2b90bf84a83dfddd0da32fd_jaffacakes118.exe	34
PID 2536 wrote to memory of 2620	2536	35c82cd9f2b90bf84a83dfddd0da32fd_jaffacakes118.exe	34
PID 2536 wrote to memory of 2620	2536	35c82cd9f2b90bf84a83dfddd0da32fd_jaffacakes118.exe	34
PID 2536 wrote to memory of 2620	2536	35c82cd9f2b90bf84a83dfddd0da32fd_jaffacakes118.exe	34
PID 2536 wrote to memory of 2620	2536	35c82cd9f2b90bf84a83dfddd0da32fd_jaffacakes118.exe	34
PID 2536 wrote to memory of 2620	2536	35c82cd9f2b90bf84a83dfddd0da32fd_jaffacakes118.exe	34
PID 2536 wrote to memory of 2620	2536	35c82cd9f2b90bf84a83dfddd0da32fd_jaffacakes118.exe	34
PID 2620 wrote to memory of 2536	2620	35c82cd9f2b90bf84a83dfddd0da32fd_jaffacakes118.exe	30
PID 2620 wrote to memory of 2536	2620	35c82cd9f2b90bf84a83dfddd0da32fd_jaffacakes118.exe	30
PID 2620 wrote to memory of 2536	2620	35c82cd9f2b90bf84a83dfddd0da32fd_jaffacakes118.exe	30
PID 2620 wrote to memory of 2536	2620	35c82cd9f2b90bf84a83dfddd0da32fd_jaffacakes118.exe	30
PID 2620 wrote to memory of 2536	2620	35c82cd9f2b90bf84a83dfddd0da32fd_jaffacakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\35c82cd9f2b90bf84a83dfddd0da32fd_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\35c82cd9f2b90bf84a83dfddd0da32fd_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1848
- C:\Users\Admin\AppData\Local\Temp\35c82cd9f2b90bf84a83dfddd0da32fd_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\35c82cd9f2b90bf84a83dfddd0da32fd_JaffaCakes118.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2896
- - C:\Users\Admin\AppData\Local\Temp\35c82cd9f2b90bf84a83dfddd0da32fd_jaffacakes118\35c82cd9f2b90bf84a83dfddd0da32fd_jaffacakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\35c82cd9f2b90bf84a83dfddd0da32fd_jaffacakes118\35c82cd9f2b90bf84a83dfddd0da32fd_jaffacakes118.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2536
  - - C:\Users\Admin\AppData\Local\Temp\35c82cd9f2b90bf84a83dfddd0da32fd_jaffacakes118\35c82cd9f2b90bf84a83dfddd0da32fd_jaffacakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\35c82cd9f2b90bf84a83dfddd0da32fd_jaffacakes118\35c82cd9f2b90bf84a83dfddd0da32fd_jaffacakes118.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2620
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 1000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\35c82cd9f2b90bf84a83dfddd0da32fd_JaffaCakes118.exe"
    3⤵
    - Deletes itself
    - Suspicious use of WriteProcessMemory
    PID:2596
  - - C:\Windows\SysWOW64\PING.EXE
      ping 1.1.1.1 -n 1 -w 1000
      4⤵
      Runs ping.exe
      PID:1056

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:2116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\35c82cd9f2b90bf84a83dfddd0da32fd_jaffacakes118\35c82cd9f2b90bf84a83dfddd0da32fd_jaffacakes118.exe

Filesize
598KB

MD5
35c82cd9f2b90bf84a83dfddd0da32fd

SHA1
97cf182a5b40a5fcf320ee92adee47eabc9c41a9

SHA256
bf390af80de742815f82101b0694d401810c2c7fa165afbbcaba73f70439db8e

SHA512
7805249c5b7ee474c9cbc2d684ebc220d939d210d095414117e55db416dc56c30f59ddba139290a92fbea91c98e3ce8289e262fe670a558725777fdfadd37a16

Download Submit
C:\Users\Admin\AppData\Roaming\Imminent\Path.dat

Filesize
36B

MD5
51697ffee1aed82968498556e0405f14

SHA1
1eafad9fa688a23ec8a06e3c46d0330d10c6ed63

SHA256
bbc918e57061124449612cf763babcea913ee8e90d9275b3cfb35c70c25a8210

SHA512
6659f6ded8d4037666d44af349eb999418c9f8a1d13bc5bc20ec146fbf6db92cac737a9cd3c6664b1a331e74794bea0f82b77e132ad59725bed13ba16b40700d

Download Submit
C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch

Filesize
478B

MD5
e669f0ffce4d8a6c82368aa008d71553

SHA1
3217df6b61fd7c7d04dceca42b42d3dec2b79487

SHA256
d2b60527721c95292720bac375d4878fa62ca7d3e0f2594aa8681c4328a3c4cf

SHA512
c1cd4fd4abe2d535c1cae0e96dc92a964894d1043c08cb60fb80ba13f7fd171c27fb07555c2020c2c110e2e5fd09f02a9c500c7f5e26a8be08d2b0a152ed6f65

Download Submit
memory/1848-22-0x0000000000230000-0x0000000000235000-memory.dmp

Filesize
20KB

Download
memory/1848-19-0x0000000000230000-0x0000000000235000-memory.dmp

Filesize
20KB

Download
memory/1848-1-0x0000000074A50000-0x0000000074FFB000-memory.dmp

Filesize
5.7MB

Download
memory/1848-0-0x0000000074A51000-0x0000000074A52000-memory.dmp

Filesize
4KB

Download
memory/1848-2-0x0000000074A50000-0x0000000074FFB000-memory.dmp

Filesize
5.7MB

Download
memory/1848-16-0x0000000000230000-0x0000000000235000-memory.dmp

Filesize
20KB

Download
memory/1848-15-0x0000000074A50000-0x0000000074FFB000-memory.dmp

Filesize
5.7MB

Download
memory/1848-25-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/1848-24-0x0000000000230000-0x0000000000235000-memory.dmp

Filesize
20KB

Download
memory/1848-18-0x0000000000230000-0x0000000000235000-memory.dmp

Filesize
20KB

Download
memory/1848-3-0x0000000074A50000-0x0000000074FFB000-memory.dmp

Filesize
5.7MB

Download
memory/2536-51-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/2536-48-0x00000000003D0000-0x00000000003D5000-memory.dmp

Filesize
20KB

Download
memory/2536-46-0x00000000003D0000-0x00000000003D5000-memory.dmp

Filesize
20KB

Download
memory/2536-44-0x00000000003D0000-0x00000000003D5000-memory.dmp

Filesize
20KB

Download
memory/2896-8-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2896-36-0x0000000074A50000-0x0000000074FFB000-memory.dmp

Filesize
5.7MB

Download
memory/2896-10-0x0000000074A50000-0x0000000074FFB000-memory.dmp

Filesize
5.7MB

Download
memory/2896-9-0x0000000074A50000-0x0000000074FFB000-memory.dmp

Filesize
5.7MB

Download
memory/2896-6-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2896-4-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download