imminent | 6f8eba1ab9c3dfb62c267f46e25e70021ac4b7eeeef6601fd5b2aa35fbab5d94

General

Target

7f1113759d043a2c80292266b6362eb6_JaffaCakes118.exe
Size

651KB
MD5

7f1113759d043a2c80292266b6362eb6
SHA1

90be21b50046af5eba74e6632623fb2aac6d5e14
SHA256

6f8eba1ab9c3dfb62c267f46e25e70021ac4b7eeeef6601fd5b2aa35fbab5d94
SHA512

6aaa039653d66cf0b719223dec54f710a66ff38c4ec2eaa63d02b8c3d3282d727850fb098f8ca1cb072b534d74192f577640f376af051dbdd6384740bcc4f4b1
SSDEEP

12288:wFetEQ3+mwI86GbFGUMpKBosjzA+BLPD:w4PuLx6wFrMN+BL7

Score

10^/10

imminent persistence spyware trojan

Malware Config

Signatures

Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
trojan spyware imminent

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows = "C:\\Users\\Admin\\AppData\\Roaming\\Windows\\windows.exe"	7f1113759d043a2c80292266b6362eb6_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows = "\\Windows\\windows.exe"	7f1113759d043a2c80292266b6362eb6_JaffaCakes118.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	C:\Windows\assembly\Desktop.ini	7f1113759d043a2c80292266b6362eb6_JaffaCakes118.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	7f1113759d043a2c80292266b6362eb6_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4888 set thread context of 3792	4888	7f1113759d043a2c80292266b6362eb6_JaffaCakes118.exe	99

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\Desktop.ini	7f1113759d043a2c80292266b6362eb6_JaffaCakes118.exe
File created	C:\Windows\windows.exe	7f1113759d043a2c80292266b6362eb6_JaffaCakes118.exe
File opened for modification	C:\Windows\windows.exe	7f1113759d043a2c80292266b6362eb6_JaffaCakes118.exe
File opened for modification	C:\Windows\assembly	7f1113759d043a2c80292266b6362eb6_JaffaCakes118.exe
File created	C:\Windows\assembly\Desktop.ini	7f1113759d043a2c80292266b6362eb6_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
4888	7f1113759d043a2c80292266b6362eb6_JaffaCakes118.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3792	7f1113759d043a2c80292266b6362eb6_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	4888	7f1113759d043a2c80292266b6362eb6_JaffaCakes118.exe
Token: 33	4888	7f1113759d043a2c80292266b6362eb6_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	4888	7f1113759d043a2c80292266b6362eb6_JaffaCakes118.exe
Token: SeDebugPrivilege	3792	7f1113759d043a2c80292266b6362eb6_JaffaCakes118.exe
Token: SeDebugPrivilege	3792	7f1113759d043a2c80292266b6362eb6_JaffaCakes118.exe
Token: 33	3792	7f1113759d043a2c80292266b6362eb6_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	3792	7f1113759d043a2c80292266b6362eb6_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3792	7f1113759d043a2c80292266b6362eb6_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4888 wrote to memory of 3792	4888	7f1113759d043a2c80292266b6362eb6_JaffaCakes118.exe	99
PID 4888 wrote to memory of 3792	4888	7f1113759d043a2c80292266b6362eb6_JaffaCakes118.exe	99
PID 4888 wrote to memory of 3792	4888	7f1113759d043a2c80292266b6362eb6_JaffaCakes118.exe	99
PID 4888 wrote to memory of 3792	4888	7f1113759d043a2c80292266b6362eb6_JaffaCakes118.exe	99
PID 4888 wrote to memory of 3792	4888	7f1113759d043a2c80292266b6362eb6_JaffaCakes118.exe	99
PID 4888 wrote to memory of 3792	4888	7f1113759d043a2c80292266b6362eb6_JaffaCakes118.exe	99
PID 4888 wrote to memory of 3792	4888	7f1113759d043a2c80292266b6362eb6_JaffaCakes118.exe	99
PID 4888 wrote to memory of 3792	4888	7f1113759d043a2c80292266b6362eb6_JaffaCakes118.exe	99

C:\Users\Admin\AppData\Local\Temp\7f1113759d043a2c80292266b6362eb6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\7f1113759d043a2c80292266b6362eb6_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4888
- C:\Users\Admin\AppData\Local\Temp\7f1113759d043a2c80292266b6362eb6_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\7f1113759d043a2c80292266b6362eb6_JaffaCakes118.exe"
  2⤵
  - Adds Run key to start application
  - Drops desktop.ini file(s)
  - Drops file in Windows directory
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:3792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Imminent\Path.dat

Filesize
50B

MD5
43649950679fc5173a705bed43ffdb9b

SHA1
60a10a2e4048d55d147b0e3f469675fe2ac0f0dd

SHA256
57a84af898a451a5ceb3bc4b74bf4ca1f912cd9aadbb5bba36fe7bcdac0f6370

SHA512
511c6cb74ff95ad23af2bea07426107647ef20691fbbc596b582db95ac9eedebec11c8ff63f7f9d184df4649b1bdda5b7d12475d8805b42fcbfd32ebabac2027

Download Submit
memory/3792-5-0x0000000075200000-0x00000000757B1000-memory.dmp

Filesize
5.7MB

Download
memory/3792-6-0x0000000075200000-0x00000000757B1000-memory.dmp

Filesize
5.7MB

Download
memory/3792-7-0x0000000075200000-0x00000000757B1000-memory.dmp

Filesize
5.7MB

Download
memory/3792-40-0x0000000075200000-0x00000000757B1000-memory.dmp

Filesize
5.7MB

Download
memory/4888-0-0x0000000075202000-0x0000000075203000-memory.dmp

Filesize
4KB

Download
memory/4888-1-0x0000000075200000-0x00000000757B1000-memory.dmp

Filesize
5.7MB

Download
memory/4888-2-0x0000000075200000-0x00000000757B1000-memory.dmp

Filesize
5.7MB

Download
memory/4888-18-0x0000000075200000-0x00000000757B1000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads