imminent | 20408828648dda9ca5cf43e2b3d5f0937fcad545b9e28380edd03e992086ac8f

General

Target

917a710a90cf864397280cf6dae469d6_JaffaCakes118.exe
Size

919KB
MD5

917a710a90cf864397280cf6dae469d6
SHA1

314b6a24cabc47bebd3bcf3d7bbb1f26717872c8
SHA256

20408828648dda9ca5cf43e2b3d5f0937fcad545b9e28380edd03e992086ac8f
SHA512

abadff2e10b82fb3879f13c3761d251c2f8b1123e9b0748ef57dfe086d8e642eee916cbb8b4c335cd86d4a6ebc06cf7f82070ab07b3976b9bf2a848995b14936
SSDEEP

12288:4OvTLDi4ZJkC5KnkKu59bbk33H4U6l2dI7k:4QTCKkIRW3Xml2d

Score

10^/10

imminent persistence spyware trojan

Malware Config

Signatures

Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
trojan spyware imminent

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	917a710a90cf864397280cf6dae469d6_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	client3.exe

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winscit.exe	client3.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winscit.exe	client3.exe

Executes dropped EXE 1 IoCs

pid	Process
2692	winscit.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Defender = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\winscit.exe -boot"	winscit.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	C:\Windows\assembly\Desktop.ini	InstallUtil.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	InstallUtil.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2692 set thread context of 3300	2692	winscit.exe	110

Drops file in Windows directory 7 IoCs

description	ioc	Process
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch.new	917a710a90cf864397280cf6dae469d6_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch.new	client3.exe
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch.new	client3.exe
File opened for modification	C:\Windows\assembly	InstallUtil.exe
File created	C:\Windows\assembly\Desktop.ini	InstallUtil.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	InstallUtil.exe
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch.new	917a710a90cf864397280cf6dae469d6_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2692	winscit.exe
2692	winscit.exe
2692	winscit.exe
2692	winscit.exe
2692	winscit.exe
2692	winscit.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2608	917a710a90cf864397280cf6dae469d6_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	2608	917a710a90cf864397280cf6dae469d6_JaffaCakes118.exe
Token: SeDebugPrivilege	3312	client3.exe
Token: SeDebugPrivilege	2692	winscit.exe
Token: SeDebugPrivilege	3300	InstallUtil.exe
Token: 33	3300	InstallUtil.exe
Token: SeIncBasePriorityPrivilege	3300	InstallUtil.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3300	InstallUtil.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 2608 wrote to memory of 3312	2608	917a710a90cf864397280cf6dae469d6_JaffaCakes118.exe	93
PID 2608 wrote to memory of 3312	2608	917a710a90cf864397280cf6dae469d6_JaffaCakes118.exe	93
PID 2608 wrote to memory of 3312	2608	917a710a90cf864397280cf6dae469d6_JaffaCakes118.exe	93
PID 3312 wrote to memory of 4428	3312	client3.exe	99
PID 3312 wrote to memory of 4428	3312	client3.exe	99
PID 3312 wrote to memory of 4428	3312	client3.exe	99
PID 4952 wrote to memory of 2692	4952	explorer.exe	101
PID 4952 wrote to memory of 2692	4952	explorer.exe	101
PID 4952 wrote to memory of 2692	4952	explorer.exe	101
PID 2692 wrote to memory of 3300	2692	winscit.exe	110
PID 2692 wrote to memory of 3300	2692	winscit.exe	110
PID 2692 wrote to memory of 3300	2692	winscit.exe	110
PID 2692 wrote to memory of 3300	2692	winscit.exe	110
PID 2692 wrote to memory of 3300	2692	winscit.exe	110
PID 2692 wrote to memory of 3300	2692	winscit.exe	110
PID 2692 wrote to memory of 3300	2692	winscit.exe	110
PID 2692 wrote to memory of 3300	2692	winscit.exe	110

C:\Users\Admin\AppData\Local\Temp\917a710a90cf864397280cf6dae469d6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\917a710a90cf864397280cf6dae469d6_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2608
- C:\Users\Admin\AppData\Local\Temp\client3.exe
  "C:\Users\Admin\AppData\Local\Temp\client3.exe"
  2⤵
  - Checks computer location settings
  - Drops startup file
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3312
- - C:\Windows\SysWOW64\explorer.exe
    "C:\Windows\System32\explorer.exe" /c select, C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winscit.exe
    3⤵
    PID:4428

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:4952
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winscit.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winscit.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2692
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe"
    3⤵
    - Drops desktop.ini file(s)
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:3300

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:4840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winscit.exe

Filesize
919KB

MD5
917a710a90cf864397280cf6dae469d6

SHA1
314b6a24cabc47bebd3bcf3d7bbb1f26717872c8

SHA256
20408828648dda9ca5cf43e2b3d5f0937fcad545b9e28380edd03e992086ac8f

SHA512
abadff2e10b82fb3879f13c3761d251c2f8b1123e9b0748ef57dfe086d8e642eee916cbb8b4c335cd86d4a6ebc06cf7f82070ab07b3976b9bf2a848995b14936

Download Submit
C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch

Filesize
400B

MD5
213464de4245975117dba45463d03182

SHA1
d59ac9c78bdfb9d1205f177450e29cd6ac53c2d2

SHA256
7793d73069d9c977a809f0c518d0d1c1ef04050a651ba1e95e54fbe0424e265a

SHA512
ccf74aa3afa3128b26db7c8628e43586e453c6e61b4d2e0c03fbc790b162c428fcf4ef4b2d153094bc88b69d723c1539a8506b5ba63f92d23102c8a0f71c23f4

Download Submit
C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch

Filesize
830B

MD5
ef774af91a3dc4c92ca0404507fe19fa

SHA1
b4f77bd3d295fb8f4c4b9b7f405f8c790eaa0a27

SHA256
5d527f7147be0c0209c2934332cf1a7532ad5d596167a4acf0b8b514963ce993

SHA512
869f99bb4e88d1e2a687fbbd5308f06770c58add06192e525888049aaf78c264a153df04318bb5fc63000d32ff383161a1d50fb8d1f845fa345884655be186aa

Download Submit
C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch

Filesize
478B

MD5
02f05024464f69e9efbd5733d11d5a14

SHA1
5a1eff24d58443461242c1c042884b71905e0a13

SHA256
678759c8ca37c28aac88208311c5f4d4e1d19176039ebb749eb946ac0582be50

SHA512
985f73a2ee553548916c32ba455889cdbe3dee4644cc89b52d094dc3e5d9355d66c18a1e99de5bc0c2c318adddee0241d02bde2c8fe7c52c91b4aef4bb62d372

Download Submit
memory/2608-1-0x0000000074CB0000-0x0000000075261000-memory.dmp

Filesize
5.7MB

Download
memory/2608-2-0x0000000074CB0000-0x0000000075261000-memory.dmp

Filesize
5.7MB

Download
memory/2608-3-0x0000000074CB0000-0x0000000075261000-memory.dmp

Filesize
5.7MB

Download
memory/2608-0-0x0000000074CB2000-0x0000000074CB3000-memory.dmp

Filesize
4KB

Download
memory/2608-13-0x0000000074CB0000-0x0000000075261000-memory.dmp

Filesize
5.7MB

Download
memory/3312-9-0x0000000074CB0000-0x0000000075261000-memory.dmp

Filesize
5.7MB

Download
memory/3312-15-0x0000000074CB0000-0x0000000075261000-memory.dmp

Filesize
5.7MB

Download
memory/3312-25-0x0000000074CB0000-0x0000000075261000-memory.dmp

Filesize
5.7MB

Download
memory/3312-14-0x0000000074CB0000-0x0000000075261000-memory.dmp

Filesize
5.7MB

Download
memory/3312-10-0x0000000074CB0000-0x0000000075261000-memory.dmp

Filesize
5.7MB

Download
memory/3312-8-0x0000000074CB0000-0x0000000075261000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads