imminent | 20408828648dda9ca5cf43e2b3d5f0937fcad545b9e28380edd03e992086ac8f

General

Target

917a710a90cf864397280cf6dae469d6_JaffaCakes118.exe
Size

919KB
MD5

917a710a90cf864397280cf6dae469d6
SHA1

314b6a24cabc47bebd3bcf3d7bbb1f26717872c8
SHA256

20408828648dda9ca5cf43e2b3d5f0937fcad545b9e28380edd03e992086ac8f
SHA512

abadff2e10b82fb3879f13c3761d251c2f8b1123e9b0748ef57dfe086d8e642eee916cbb8b4c335cd86d4a6ebc06cf7f82070ab07b3976b9bf2a848995b14936
SSDEEP

12288:4OvTLDi4ZJkC5KnkKu59bbk33H4U6l2dI7k:4QTCKkIRW3Xml2d

Score

10^/10

imminent persistence spyware trojan

Malware Config

Signatures

Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
trojan spyware imminent

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winscit.exe	client3.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winscit.exe	client3.exe

Executes dropped EXE 1 IoCs

pid	Process
2488	winscit.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Defender = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\winscit.exe -boot"	winscit.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2488 set thread context of 1576	2488	winscit.exe	34

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch.new	client3.exe
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch.new	client3.exe
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch.new	917a710a90cf864397280cf6dae469d6_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch.new	917a710a90cf864397280cf6dae469d6_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2488	winscit.exe
2488	winscit.exe
2488	winscit.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2204	917a710a90cf864397280cf6dae469d6_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	2204	917a710a90cf864397280cf6dae469d6_JaffaCakes118.exe
Token: SeDebugPrivilege	2940	client3.exe
Token: SeDebugPrivilege	2488	winscit.exe
Token: SeDebugPrivilege	1576	InstallUtil.exe
Token: 33	1576	InstallUtil.exe
Token: SeIncBasePriorityPrivilege	1576	InstallUtil.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1576	InstallUtil.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 2940	2204	917a710a90cf864397280cf6dae469d6_JaffaCakes118.exe	28
PID 2204 wrote to memory of 2940	2204	917a710a90cf864397280cf6dae469d6_JaffaCakes118.exe	28
PID 2204 wrote to memory of 2940	2204	917a710a90cf864397280cf6dae469d6_JaffaCakes118.exe	28
PID 2204 wrote to memory of 2940	2204	917a710a90cf864397280cf6dae469d6_JaffaCakes118.exe	28
PID 2940 wrote to memory of 1192	2940	client3.exe	31
PID 2940 wrote to memory of 1192	2940	client3.exe	31
PID 2940 wrote to memory of 1192	2940	client3.exe	31
PID 2940 wrote to memory of 1192	2940	client3.exe	31
PID 2656 wrote to memory of 2488	2656	explorer.exe	33
PID 2656 wrote to memory of 2488	2656	explorer.exe	33
PID 2656 wrote to memory of 2488	2656	explorer.exe	33
PID 2656 wrote to memory of 2488	2656	explorer.exe	33
PID 2488 wrote to memory of 1576	2488	winscit.exe	34
PID 2488 wrote to memory of 1576	2488	winscit.exe	34
PID 2488 wrote to memory of 1576	2488	winscit.exe	34
PID 2488 wrote to memory of 1576	2488	winscit.exe	34
PID 2488 wrote to memory of 1576	2488	winscit.exe	34
PID 2488 wrote to memory of 1576	2488	winscit.exe	34
PID 2488 wrote to memory of 1576	2488	winscit.exe	34
PID 2488 wrote to memory of 1576	2488	winscit.exe	34
PID 2488 wrote to memory of 1576	2488	winscit.exe	34
PID 2488 wrote to memory of 1576	2488	winscit.exe	34
PID 2488 wrote to memory of 1576	2488	winscit.exe	34
PID 2488 wrote to memory of 1576	2488	winscit.exe	34

C:\Users\Admin\AppData\Local\Temp\917a710a90cf864397280cf6dae469d6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\917a710a90cf864397280cf6dae469d6_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Users\Admin\AppData\Local\Temp\client3.exe
  "C:\Users\Admin\AppData\Local\Temp\client3.exe"
  2⤵
  - Drops startup file
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2940
- - C:\Windows\SysWOW64\explorer.exe
    "C:\Windows\System32\explorer.exe" /c select, C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winscit.exe
    3⤵
    PID:1192

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:2656
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winscit.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winscit.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2488
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:1576

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:1832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winscit.exe

Filesize
919KB

MD5
917a710a90cf864397280cf6dae469d6

SHA1
314b6a24cabc47bebd3bcf3d7bbb1f26717872c8

SHA256
20408828648dda9ca5cf43e2b3d5f0937fcad545b9e28380edd03e992086ac8f

SHA512
abadff2e10b82fb3879f13c3761d251c2f8b1123e9b0748ef57dfe086d8e642eee916cbb8b4c335cd86d4a6ebc06cf7f82070ab07b3976b9bf2a848995b14936

Download Submit
C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch

Filesize
400B

MD5
e632519d74c73a3734ea0d722c3af63d

SHA1
70d7910cb46510839d5bf81ce0a29a2b27d158fd

SHA256
606a2094321581e378dd64619f17835c18684faaed67bfb4326dad1d69950808

SHA512
1f6edb0d976c900be4e01fa3054467b654127c7cf40ef14aa618e762917f31aba2b52436f444a5a369fc8e70a907cb8a1dfe3edddb8741fbc7b1a4b171ad439d

Download Submit
C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch

Filesize
830B

MD5
157cd5fc8ebe4f5fe555e60978361922

SHA1
f2e13669906c646a72eb566b52b1de29d9ceb82d

SHA256
e430ccaa131307f12a5679125f92a646108e21093cd9aaacae03a0f70755b04f

SHA512
d1aacc630e97c828dee1983358cd0dde4b12a38d30e9583df063ba38977435d2c25c8eb194d9fe6545fefd45451001fd997229a26c6d89c0a89d8a79878a572f

Download Submit
C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch

Filesize
478B

MD5
a95eea54f6b8d2e61b6b95462adabd68

SHA1
5aa6a67406032a6cfa6d5e0307caa5fe1b9bc017

SHA256
bb644f378db7e044bcebb8bfe1f1a06f4fb07618088936ca88750cde647070e8

SHA512
9d3a1a73006996fa57e686f8e6090fd71802251b50e5d4a856be53816c1182d5ec822ce208cbf05163e15095b14187af00fdcd6f9afd39d90a9904774d3b27f9

Download Submit
memory/1576-31-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/1576-30-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/1576-29-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2204-3-0x0000000074470000-0x0000000074A1B000-memory.dmp

Filesize
5.7MB

Download
memory/2204-11-0x0000000074470000-0x0000000074A1B000-memory.dmp

Filesize
5.7MB

Download
memory/2204-0-0x0000000074471000-0x0000000074472000-memory.dmp

Filesize
4KB

Download
memory/2204-1-0x0000000074470000-0x0000000074A1B000-memory.dmp

Filesize
5.7MB

Download
memory/2204-2-0x0000000074470000-0x0000000074A1B000-memory.dmp

Filesize
5.7MB

Download
memory/2940-12-0x0000000074470000-0x0000000074A1B000-memory.dmp

Filesize
5.7MB

Download
memory/2940-23-0x0000000074470000-0x0000000074A1B000-memory.dmp

Filesize
5.7MB

Download
memory/2940-14-0x0000000074470000-0x0000000074A1B000-memory.dmp

Filesize
5.7MB

Download
memory/2940-13-0x0000000074470000-0x0000000074A1B000-memory.dmp

Filesize
5.7MB

Download
memory/2940-7-0x0000000074470000-0x0000000074A1B000-memory.dmp

Filesize
5.7MB

Download
memory/2940-10-0x0000000074470000-0x0000000074A1B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads