Analysis
-
max time kernel
150s -
max time network
102s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
26-05-2024 15:13
General
-
Target
75e46df89a356a452c6c29a75964d3fc_JaffaCakes118.exe
-
Size
1.5MB
-
MD5
75e46df89a356a452c6c29a75964d3fc
-
SHA1
823e2d3ef005d36b1401472dd5fd687a652b81b0
-
SHA256
cb84010badac25e5bad6137e5f46f3ee05be2fea3bbb065fbbb18075e7ee5df1
-
SHA512
f4b56b6882e5fc9b5550a09694a1a456a305e8a7d84a9e5189ec1411e28166d1e120033101bca60c80dd9d0344017653aaec47c6bdc7057b3f7e4ade526c2119
-
SSDEEP
24576:OAHnh+eWsN3skA4RV1Hom2KXMmHaZLS6SQBCZNRrrBJXq2ceUgQAK/5:5h+ZkldoPK8YaZLSi
Malware Config
Signatures
-
Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
-
Executes dropped EXE 3 IoCs
-
Adds Run key to start application 2 TTPs 3 IoCs
-
Drops desktop.ini file(s) 2 IoCs
-
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
-
Suspicious use of SetThreadContext 1 IoCs
-
Drops file in Windows directory 3 IoCs
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\75e46df89a356a452c6c29a75964d3fc_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\75e46df89a356a452c6c29a75964d3fc_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /tn npudibozpm /tr C:\Users\Admin\AppData\Roaming\Roaming\lsass.exe /sc minute /mo 12⤵
- Creates scheduled task(s)
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"2⤵
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Roaming\lsass.exeC:\Users\Admin\AppData\Roaming\Roaming\lsass.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Roaming\lsass.exeC:\Users\Admin\AppData\Roaming\Roaming\lsass.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Roaming\lsass.exeC:\Users\Admin\AppData\Roaming\Roaming\lsass.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
65B
MD5273fff8bf9d33aff94e61118086b8e12
SHA1651020cf6d05a0a4b06c80b995d95550d10c86e4
SHA256590920795bd9a5c2a36831ca476220c030e54ead92420bf8c60871984843f760
SHA5127e7c49e8bd21d6838ce1f17626d70b7973a1f2d0ece0bead742a956a2645227adf0c890c746448afa97c2a80c59a0ca4edbc85be265a0ff93a1710fb4962307f
-
Filesize
1.5MB
MD575e46df89a356a452c6c29a75964d3fc
SHA1823e2d3ef005d36b1401472dd5fd687a652b81b0
SHA256cb84010badac25e5bad6137e5f46f3ee05be2fea3bbb065fbbb18075e7ee5df1
SHA512f4b56b6882e5fc9b5550a09694a1a456a305e8a7d84a9e5189ec1411e28166d1e120033101bca60c80dd9d0344017653aaec47c6bdc7057b3f7e4ade526c2119
-
Filesize
344KB
-
Filesize
4KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
4KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
4KB
-
Filesize
4KB