imminent | 20bbb3f029a157dfb72a4ff3c8c004d036c387409239d424d8acef7590d80d3a

General

Target

95c13c093af79e225282384aeaf654fe_JaffaCakes118.exe
Size

375KB
MD5

95c13c093af79e225282384aeaf654fe
SHA1

318e3cbbbdeb0c2dadebd96fa926a185d2338415
SHA256

20bbb3f029a157dfb72a4ff3c8c004d036c387409239d424d8acef7590d80d3a
SHA512

b5b66e6d32b9988f521e499f6aa85ffc1ff9a3b01dbeb2e71ceedfef8105048c114566f6497316e696a28202db0fb3b44f0afb0fa1a31fb02f1465cfc41f23b2
SSDEEP

6144:OT7TokKC82Vj/aqda+4q3c/bofNVNMbINgKg0LNTUrxj2nCvDI:gvo3C80j5SdDofNVabISKgETUtjeCvD

Score

10^/10

imminent spyware trojan

Malware Config

Signatures

Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
trojan spyware imminent

Executes dropped EXE 1 IoCs

pid	Process
3996	95c13c093af79e225282384aeaf654fe_JaffaCakes118.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	C:\Windows\assembly\Desktop.ini	95c13c093af79e225282384aeaf654fe_JaffaCakes118.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	95c13c093af79e225282384aeaf654fe_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3484 set thread context of 3996	3484	95c13c093af79e225282384aeaf654fe_JaffaCakes118.exe	91

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\Desktop.ini	95c13c093af79e225282384aeaf654fe_JaffaCakes118.exe
File opened for modification	C:\Windows\assembly	95c13c093af79e225282384aeaf654fe_JaffaCakes118.exe
File created	C:\Windows\assembly\Desktop.ini	95c13c093af79e225282384aeaf654fe_JaffaCakes118.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3996	95c13c093af79e225282384aeaf654fe_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3484	95c13c093af79e225282384aeaf654fe_JaffaCakes118.exe
Token: SeDebugPrivilege	3996	95c13c093af79e225282384aeaf654fe_JaffaCakes118.exe
Token: 33	3996	95c13c093af79e225282384aeaf654fe_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	3996	95c13c093af79e225282384aeaf654fe_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3996	95c13c093af79e225282384aeaf654fe_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3484 wrote to memory of 3996	3484	95c13c093af79e225282384aeaf654fe_JaffaCakes118.exe	91
PID 3484 wrote to memory of 3996	3484	95c13c093af79e225282384aeaf654fe_JaffaCakes118.exe	91
PID 3484 wrote to memory of 3996	3484	95c13c093af79e225282384aeaf654fe_JaffaCakes118.exe	91
PID 3484 wrote to memory of 3996	3484	95c13c093af79e225282384aeaf654fe_JaffaCakes118.exe	91
PID 3484 wrote to memory of 3996	3484	95c13c093af79e225282384aeaf654fe_JaffaCakes118.exe	91
PID 3484 wrote to memory of 3996	3484	95c13c093af79e225282384aeaf654fe_JaffaCakes118.exe	91
PID 3484 wrote to memory of 3996	3484	95c13c093af79e225282384aeaf654fe_JaffaCakes118.exe	91
PID 3484 wrote to memory of 3996	3484	95c13c093af79e225282384aeaf654fe_JaffaCakes118.exe	91

C:\Users\Admin\AppData\Local\Temp\95c13c093af79e225282384aeaf654fe_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\95c13c093af79e225282384aeaf654fe_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3484
- C:\Users\Admin\AppData\Local\Temp\95c13c093af79e225282384aeaf654fe_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\95c13c093af79e225282384aeaf654fe_JaffaCakes118.exe"
  2⤵
  - Executes dropped EXE
  - Drops desktop.ini file(s)
  - Drops file in Windows directory
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:3996

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:2508

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4232 --field-trial-handle=2656,i,16940681401824032220,151921362336696246,262144 --variations-seed-version /prefetch:8
1⤵
PID:3448

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\95c13c093af79e225282384aeaf654fe_JaffaCakes118.exe

Filesize
375KB

MD5
95c13c093af79e225282384aeaf654fe

SHA1
318e3cbbbdeb0c2dadebd96fa926a185d2338415

SHA256
20bbb3f029a157dfb72a4ff3c8c004d036c387409239d424d8acef7590d80d3a

SHA512
b5b66e6d32b9988f521e499f6aa85ffc1ff9a3b01dbeb2e71ceedfef8105048c114566f6497316e696a28202db0fb3b44f0afb0fa1a31fb02f1465cfc41f23b2

Download Submit
memory/3484-12-0x0000000074F80000-0x0000000075531000-memory.dmp

Filesize
5.7MB

Download
memory/3484-1-0x0000000074F80000-0x0000000075531000-memory.dmp

Filesize
5.7MB

Download
memory/3484-2-0x0000000074F80000-0x0000000075531000-memory.dmp

Filesize
5.7MB

Download
memory/3484-3-0x0000000074F80000-0x0000000075531000-memory.dmp

Filesize
5.7MB

Download
memory/3484-13-0x0000000074F80000-0x0000000075531000-memory.dmp

Filesize
5.7MB

Download
memory/3484-0-0x0000000074F82000-0x0000000074F83000-memory.dmp

Filesize
4KB

Download
memory/3996-6-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/3996-9-0x0000000074F80000-0x0000000075531000-memory.dmp

Filesize
5.7MB

Download
memory/3996-10-0x0000000074F80000-0x0000000075531000-memory.dmp

Filesize
5.7MB

Download
memory/3996-5-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/3996-4-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/3996-14-0x0000000074F80000-0x0000000075531000-memory.dmp

Filesize
5.7MB

Download
memory/3996-22-0x0000000074F80000-0x0000000075531000-memory.dmp

Filesize
5.7MB

Download
memory/3996-23-0x0000000074F80000-0x0000000075531000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing