imminent | b01bde2ab9138e6cae1cffee530554172794ef1abfcc32900a375c30cb16ef48

Analysis

max time kernel
148s
max time network
154s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
02-06-2024 20:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8f6023fd5cec422fc47889d4f33eadd3_JaffaCakes118.exe
Size

493KB
MD5

8f6023fd5cec422fc47889d4f33eadd3
SHA1

d08741776a947dcf5dc04ca778ac5ca995dd4948
SHA256

b01bde2ab9138e6cae1cffee530554172794ef1abfcc32900a375c30cb16ef48
SHA512

dd39aa28108213a7d84fdc7b3a0e827dcceaee6181a6c73de7cf2cd22d018a0cd11fa201d95e5432f54ebb9985d82fdb01be56c0287cdea5510436d38b5554e7
SSDEEP

12288:sMfohPnK0D+Sij8vHNCz3rM7ewkpNjlGjWwjR:sMfoVKXIc87eOR

Score

10^/10

imminent spyware trojan

Malware Config

Signatures

Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
trojan spyware imminent

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2172 set thread context of 2124	2172	8f6023fd5cec422fc47889d4f33eadd3_JaffaCakes118.exe	28

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2124	8f6023fd5cec422fc47889d4f33eadd3_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2124	8f6023fd5cec422fc47889d4f33eadd3_JaffaCakes118.exe
Token: 33	2124	8f6023fd5cec422fc47889d4f33eadd3_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	2124	8f6023fd5cec422fc47889d4f33eadd3_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2124	8f6023fd5cec422fc47889d4f33eadd3_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 2124	2172	8f6023fd5cec422fc47889d4f33eadd3_JaffaCakes118.exe	28
PID 2172 wrote to memory of 2124	2172	8f6023fd5cec422fc47889d4f33eadd3_JaffaCakes118.exe	28
PID 2172 wrote to memory of 2124	2172	8f6023fd5cec422fc47889d4f33eadd3_JaffaCakes118.exe	28
PID 2172 wrote to memory of 2124	2172	8f6023fd5cec422fc47889d4f33eadd3_JaffaCakes118.exe	28
PID 2172 wrote to memory of 2124	2172	8f6023fd5cec422fc47889d4f33eadd3_JaffaCakes118.exe	28
PID 2172 wrote to memory of 2124	2172	8f6023fd5cec422fc47889d4f33eadd3_JaffaCakes118.exe	28
PID 2172 wrote to memory of 2124	2172	8f6023fd5cec422fc47889d4f33eadd3_JaffaCakes118.exe	28
PID 2172 wrote to memory of 2124	2172	8f6023fd5cec422fc47889d4f33eadd3_JaffaCakes118.exe	28
PID 2172 wrote to memory of 2124	2172	8f6023fd5cec422fc47889d4f33eadd3_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\8f6023fd5cec422fc47889d4f33eadd3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8f6023fd5cec422fc47889d4f33eadd3_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Users\Admin\AppData\Local\Temp\8f6023fd5cec422fc47889d4f33eadd3_JaffaCakes118.exe
  "{path}"
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2124

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:2848

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2124-15-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2124-25-0x0000000074B80000-0x000000007512B000-memory.dmp

Filesize
5.7MB

Download
memory/2124-14-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2124-13-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2124-18-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2124-22-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2124-20-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2124-16-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2124-34-0x0000000074B80000-0x000000007512B000-memory.dmp

Filesize
5.7MB

Download
memory/2124-33-0x0000000074B80000-0x000000007512B000-memory.dmp

Filesize
5.7MB

Download
memory/2124-12-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2124-28-0x0000000074B80000-0x000000007512B000-memory.dmp

Filesize
5.7MB

Download
memory/2124-26-0x0000000074B80000-0x000000007512B000-memory.dmp

Filesize
5.7MB

Download
memory/2124-24-0x0000000074B80000-0x000000007512B000-memory.dmp

Filesize
5.7MB

Download
memory/2172-1-0x0000000074B80000-0x000000007512B000-memory.dmp

Filesize
5.7MB

Download
memory/2172-23-0x0000000074B80000-0x000000007512B000-memory.dmp

Filesize
5.7MB

Download
memory/2172-2-0x0000000074B80000-0x000000007512B000-memory.dmp

Filesize
5.7MB

Download
memory/2172-0-0x0000000074B81000-0x0000000074B82000-memory.dmp

Filesize
4KB

Download