imminent | 550df7471a02ec62986380b84708162fa0dca4bf4e4eef643b1625a512a92c2a

General

Target

9a98bae4321155184d55065a53b76236_JaffaCakes118.msi
Size

2.0MB
MD5

9a98bae4321155184d55065a53b76236
SHA1

7abf0f142b3f9ca0e3508eeb14a0a752007913fd
SHA256

550df7471a02ec62986380b84708162fa0dca4bf4e4eef643b1625a512a92c2a
SHA512

744ab49e4a2c7ecf0ab84e7716a72e2ca7f7be6693e517fbadd5cb183f89532565677feaec09b906548e1c1c4593d80b587682694e20843d8e47a6c928adc2f6
SSDEEP

49152:z6G3sBlgF4UpsUzD1PPxSc+ic4AuJZDsz5MY7os0f54HnT:mG3c2hsUzDZPQScXunDsz+Yk354Hn

Score

10^/10

imminent agilenet persistence spyware trojan

Malware Config

Signatures

Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
trojan spyware imminent

Obfuscated with Agile.Net obfuscator 1 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

Processes:

resource	yara_rule
behavioral1/memory/1596-140-0x0000000000470000-0x000000000047C000-memory.dmp	agile_net

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

SynTPHelper.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\SynTPHelp = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\History\\SynTPHelper.exe -boot"	SynTPHelper.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

SynTPHelper.exe

description pid process target process

PID 1596 set thread context of 2888 1596 SynTPHelper.exe InstallUtil.exe

description	pid	process	target process
PID 1596 set thread context of 2888	1596	SynTPHelper.exe	InstallUtil.exe

Drops file in Windows directory 13 IoCs

Processes:

msiexec.exeDrvInst.exeexpand.exe

description	ioc	process
File opened for modification	C:\Windows\Installer\MSI38CC.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5F04.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Logs\DPX\setuperr.log	expand.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5EC4.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\f763812.ipi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\Installer\f763811.msi	msiexec.exe
File created	C:\Windows\Installer\f763812.ipi	msiexec.exe
File created	C:\Windows\Installer\f763811.msi	msiexec.exe
File opened for modification	C:\Windows\Logs\DPX\setupact.log	expand.exe

Executes dropped EXE 3 IoCs

Processes:

IMSynTPHelper.exeSynTPHelp.exeSynTPHelper.exe

pid process

1080 IMSynTPHelper.exe
2100 SynTPHelp.exe
1596 SynTPHelper.exe
Loads dropped DLL 7 IoCs

Processes:

MsiExec.exeMsiExec.execmd.exe

pid process

1728 MsiExec.exe
1728 MsiExec.exe
1728 MsiExec.exe
1728 MsiExec.exe
1728 MsiExec.exe
2264 MsiExec.exe
1980 cmd.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
1080	IMSynTPHelper.exe
2100	SynTPHelp.exe
1596	SynTPHelper.exe

pid	process
1728	MsiExec.exe
1728	MsiExec.exe
1728	MsiExec.exe
1728	MsiExec.exe
1728	MsiExec.exe
2264	MsiExec.exe
1980	cmd.exe

Modifies data under HKEY_USERS 46 IoCs

Processes:

DrvInst.exemsiexec.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D	msiexec.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

msiexec.exe

pid process

3052 msiexec.exe
3052 msiexec.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

InstallUtil.exe

pid process

2888 InstallUtil.exe

pid	process
3052	msiexec.exe
3052	msiexec.exe

pid	process
2888	InstallUtil.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

msiexec.exemsiexec.exevssvc.exeDrvInst.exeIMSynTPHelper.exeSynTPHelp.exe

description	pid	process
Token: SeShutdownPrivilege	2176	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2176	msiexec.exe
Token: SeRestorePrivilege	3052	msiexec.exe
Token: SeTakeOwnershipPrivilege	3052	msiexec.exe
Token: SeSecurityPrivilege	3052	msiexec.exe
Token: SeCreateTokenPrivilege	2176	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2176	msiexec.exe
Token: SeLockMemoryPrivilege	2176	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2176	msiexec.exe
Token: SeMachineAccountPrivilege	2176	msiexec.exe
Token: SeTcbPrivilege	2176	msiexec.exe
Token: SeSecurityPrivilege	2176	msiexec.exe
Token: SeTakeOwnershipPrivilege	2176	msiexec.exe
Token: SeLoadDriverPrivilege	2176	msiexec.exe
Token: SeSystemProfilePrivilege	2176	msiexec.exe
Token: SeSystemtimePrivilege	2176	msiexec.exe
Token: SeProfSingleProcessPrivilege	2176	msiexec.exe
Token: SeIncBasePriorityPrivilege	2176	msiexec.exe
Token: SeCreatePagefilePrivilege	2176	msiexec.exe
Token: SeCreatePermanentPrivilege	2176	msiexec.exe
Token: SeBackupPrivilege	2176	msiexec.exe
Token: SeRestorePrivilege	2176	msiexec.exe
Token: SeShutdownPrivilege	2176	msiexec.exe
Token: SeDebugPrivilege	2176	msiexec.exe
Token: SeAuditPrivilege	2176	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2176	msiexec.exe
Token: SeChangeNotifyPrivilege	2176	msiexec.exe
Token: SeRemoteShutdownPrivilege	2176	msiexec.exe
Token: SeUndockPrivilege	2176	msiexec.exe
Token: SeSyncAgentPrivilege	2176	msiexec.exe
Token: SeEnableDelegationPrivilege	2176	msiexec.exe
Token: SeManageVolumePrivilege	2176	msiexec.exe
Token: SeImpersonatePrivilege	2176	msiexec.exe
Token: SeCreateGlobalPrivilege	2176	msiexec.exe
Token: SeBackupPrivilege	2036	vssvc.exe
Token: SeRestorePrivilege	2036	vssvc.exe
Token: SeAuditPrivilege	2036	vssvc.exe
Token: SeBackupPrivilege	3052	msiexec.exe
Token: SeRestorePrivilege	3052	msiexec.exe
Token: SeRestorePrivilege	2692	DrvInst.exe
Token: SeRestorePrivilege	2692	DrvInst.exe
Token: SeRestorePrivilege	2692	DrvInst.exe
Token: SeRestorePrivilege	2692	DrvInst.exe
Token: SeRestorePrivilege	2692	DrvInst.exe
Token: SeRestorePrivilege	2692	DrvInst.exe
Token: SeRestorePrivilege	2692	DrvInst.exe
Token: SeLoadDriverPrivilege	2692	DrvInst.exe
Token: SeLoadDriverPrivilege	2692	DrvInst.exe
Token: SeLoadDriverPrivilege	2692	DrvInst.exe
Token: SeRestorePrivilege	3052	msiexec.exe
Token: SeTakeOwnershipPrivilege	3052	msiexec.exe
Token: SeRestorePrivilege	3052	msiexec.exe
Token: SeTakeOwnershipPrivilege	3052	msiexec.exe
Token: SeDebugPrivilege	1080	IMSynTPHelper.exe
Token: 33	1080	IMSynTPHelper.exe
Token: SeIncBasePriorityPrivilege	1080	IMSynTPHelper.exe
Token: SeDebugPrivilege	2100	SynTPHelp.exe
Token: 33	2100	SynTPHelp.exe
Token: SeIncBasePriorityPrivilege	2100	SynTPHelp.exe
Token: SeRestorePrivilege	3052	msiexec.exe
Token: SeTakeOwnershipPrivilege	3052	msiexec.exe
Token: SeRestorePrivilege	3052	msiexec.exe
Token: SeTakeOwnershipPrivilege	3052	msiexec.exe
Token: SeRestorePrivilege	3052	msiexec.exe

Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

msiexec.exeDllHost.exe

pid process

2176 msiexec.exe
2176 msiexec.exe
1076 DllHost.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

InstallUtil.exe

pid process

2888 InstallUtil.exe

pid	process
2176	msiexec.exe
2176	msiexec.exe
1076	DllHost.exe

pid	process
2888	InstallUtil.exe

Suspicious use of WriteProcessMemory 54 IoCs

Processes:

msiexec.exeMsiExec.exeIMSynTPHelper.execmd.exeSynTPHelp.exeSynTPHelper.exe

description	pid	process	target process
PID 3052 wrote to memory of 1728	3052	msiexec.exe	MsiExec.exe
PID 3052 wrote to memory of 1728	3052	msiexec.exe	MsiExec.exe
PID 3052 wrote to memory of 1728	3052	msiexec.exe	MsiExec.exe
PID 3052 wrote to memory of 1728	3052	msiexec.exe	MsiExec.exe
PID 3052 wrote to memory of 1728	3052	msiexec.exe	MsiExec.exe
PID 3052 wrote to memory of 1728	3052	msiexec.exe	MsiExec.exe
PID 3052 wrote to memory of 1728	3052	msiexec.exe	MsiExec.exe
PID 1728 wrote to memory of 2992	1728	MsiExec.exe	expand.exe
PID 1728 wrote to memory of 2992	1728	MsiExec.exe	expand.exe
PID 1728 wrote to memory of 2992	1728	MsiExec.exe	expand.exe
PID 1728 wrote to memory of 2992	1728	MsiExec.exe	expand.exe
PID 1728 wrote to memory of 1080	1728	MsiExec.exe	IMSynTPHelper.exe
PID 1728 wrote to memory of 1080	1728	MsiExec.exe	IMSynTPHelper.exe
PID 1728 wrote to memory of 1080	1728	MsiExec.exe	IMSynTPHelper.exe
PID 1728 wrote to memory of 1080	1728	MsiExec.exe	IMSynTPHelper.exe
PID 1080 wrote to memory of 1188	1080	IMSynTPHelper.exe	cmd.exe
PID 1080 wrote to memory of 1188	1080	IMSynTPHelper.exe	cmd.exe
PID 1080 wrote to memory of 1188	1080	IMSynTPHelper.exe	cmd.exe
PID 1080 wrote to memory of 1188	1080	IMSynTPHelper.exe	cmd.exe
PID 1188 wrote to memory of 2100	1188	cmd.exe	SynTPHelp.exe
PID 1188 wrote to memory of 2100	1188	cmd.exe	SynTPHelp.exe
PID 1188 wrote to memory of 2100	1188	cmd.exe	SynTPHelp.exe
PID 1188 wrote to memory of 2100	1188	cmd.exe	SynTPHelp.exe
PID 3052 wrote to memory of 2264	3052	msiexec.exe	MsiExec.exe
PID 3052 wrote to memory of 2264	3052	msiexec.exe	MsiExec.exe
PID 3052 wrote to memory of 2264	3052	msiexec.exe	MsiExec.exe
PID 3052 wrote to memory of 2264	3052	msiexec.exe	MsiExec.exe
PID 3052 wrote to memory of 2264	3052	msiexec.exe	MsiExec.exe
PID 3052 wrote to memory of 2264	3052	msiexec.exe	MsiExec.exe
PID 3052 wrote to memory of 2264	3052	msiexec.exe	MsiExec.exe
PID 2100 wrote to memory of 576	2100	SynTPHelp.exe	cmd.exe
PID 2100 wrote to memory of 576	2100	SynTPHelp.exe	cmd.exe
PID 2100 wrote to memory of 576	2100	SynTPHelp.exe	cmd.exe
PID 2100 wrote to memory of 576	2100	SynTPHelp.exe	cmd.exe
PID 2100 wrote to memory of 2940	2100	SynTPHelp.exe	cmd.exe
PID 2100 wrote to memory of 2940	2100	SynTPHelp.exe	cmd.exe
PID 2100 wrote to memory of 2940	2100	SynTPHelp.exe	cmd.exe
PID 2100 wrote to memory of 2940	2100	SynTPHelp.exe	cmd.exe
PID 2100 wrote to memory of 1980	2100	SynTPHelp.exe	cmd.exe
PID 2100 wrote to memory of 1980	2100	SynTPHelp.exe	cmd.exe
PID 2100 wrote to memory of 1980	2100	SynTPHelp.exe	cmd.exe
PID 2100 wrote to memory of 1980	2100	SynTPHelp.exe	cmd.exe
PID 1596 wrote to memory of 2888	1596	SynTPHelper.exe	InstallUtil.exe
PID 1596 wrote to memory of 2888	1596	SynTPHelper.exe	InstallUtil.exe
PID 1596 wrote to memory of 2888	1596	SynTPHelper.exe	InstallUtil.exe
PID 1596 wrote to memory of 2888	1596	SynTPHelper.exe	InstallUtil.exe
PID 1596 wrote to memory of 2888	1596	SynTPHelper.exe	InstallUtil.exe
PID 1596 wrote to memory of 2888	1596	SynTPHelper.exe	InstallUtil.exe
PID 1596 wrote to memory of 2888	1596	SynTPHelper.exe	InstallUtil.exe
PID 1596 wrote to memory of 2888	1596	SynTPHelper.exe	InstallUtil.exe
PID 1596 wrote to memory of 2888	1596	SynTPHelper.exe	InstallUtil.exe
PID 1596 wrote to memory of 2888	1596	SynTPHelper.exe	InstallUtil.exe
PID 1596 wrote to memory of 2888	1596	SynTPHelper.exe	InstallUtil.exe
PID 1596 wrote to memory of 2888	1596	SynTPHelper.exe	InstallUtil.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\9a98bae4321155184d55065a53b76236_JaffaCakes118.msi
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2176

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3052

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 57D0817120D0C491BB89C724B63CB281
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1728

C:\Windows\SysWOW64\expand.exe
"C:\Windows\System32\expand.exe" -R files.cab -F:* files
3⤵
- Drops file in Windows directory
PID:2992

C:\Users\Admin\AppData\Local\Temp\MW-0a730bff-a4ee-4bfe-9293-93af145a1216\files\IMSynTPHelper.exe
"C:\Users\Admin\AppData\Local\Temp\MW-0a730bff-a4ee-4bfe-9293-93af145a1216\files\IMSynTPHelper.exe"
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1080

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\SysWOW64\cmd.exe" /c, "C:\Users\Admin\AppData\Local\Temp\SynTPHelp.exe"
4⤵
- Suspicious use of WriteProcessMemory
PID:1188

C:\Users\Admin\AppData\Local\Temp\SynTPHelp.exe
"C:\Users\Admin\AppData\Local\Temp\SynTPHelp.exe"
5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2100

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\SysWOW64\cmd.exe" /c, "C:\Users\Admin\Documents\b106484eb915e4ad6df697dc1442cbff-EDITED.jpg"
6⤵
PID:576

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\SysWOW64\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\SynTPHelp.exe" "C:\Users\Admin\AppData\Local\Microsoft\Windows\History\SynTPHelper.exe"
6⤵
PID:2940

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\SysWOW64\cmd.exe" /c, "C:\Users\Admin\AppData\Local\Microsoft\Windows\History\SynTPHelper.exe"
6⤵
- Loads dropped DLL
PID:1980

C:\Users\Admin\AppData\Local\Microsoft\Windows\History\SynTPHelper.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\History\SynTPHelper.exe"
7⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1596

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
8⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2888

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding A58EDC7D1EA7476E8CA178CF9681342E M Global\MSI0000
2⤵
- Loads dropped DLL
PID:2264

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2036

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000005A0" "00000000000003D8"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2692

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
1⤵
- Suspicious use of FindShellTrayWindow
PID:1076

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:2696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MW-0a730bff-a4ee-4bfe-9293-93af145a1216\files.cab

Filesize
1.8MB

MD5
e9386820dcef0fb94373a902ebef0be8

SHA1
90067e9b1a618f31f13d6ddb9aae2b80a3550317

SHA256
2623b39263417ac2e7124d2c941636cc40ac899193c6f37aeb4770846e1dfd5b

SHA512
1abf56744def334f944b49a6a1c58e205b6c4f318908078679dc74317582d83c69165b46e965573d1110d0197e6a39608e0b0a80a0b410a92bfd7c2bed021511

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-0a730bff-a4ee-4bfe-9293-93af145a1216\files\IMSynTPHelper.exe

Filesize
1.8MB

MD5
fd35e3dede843aa7bb4aa89349f82356

SHA1
f20157d7feaabe773c4fbe23f1cb5568e1662a2a

SHA256
fcf7eb055d5188a51816fa9147ced8a1d88290dd249d1ced2c77c57a35d2068d

SHA512
50e3d66edb1cc0992edfe85077046168b4cdd05d0d4711e72e6d7069db5b9ed601eed1caac0d27adf654f9cdedcd27e2c9e466584921df95eb7a0be9cf673a08

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-0a730bff-a4ee-4bfe-9293-93af145a1216\msiwrapper.ini

Filesize
488B

MD5
4b62099ff4a1e278ed407d7fc29057fe

SHA1
6f70db9402ff84571dd5c68ed530326148659516

SHA256
a840491f6d5bebf53be89e561acde3ab9bc2c2334c02e257f4ddd294e20a35d5

SHA512
cf79382b39c22aa0cff0fa2389d6cd20193f4c86a47a23e1ea6fed0ca840bac136f979ff5c0908d72c5f4810cacb70b41b1a4c39e8a3219d7b4caada1d63de10

Download Submit
C:\Users\Admin\Documents\b106484eb915e4ad6df697dc1442cbff-EDITED.jpg

Filesize
1.2MB

MD5
5b9849e016ab5210cbc8e78a1fdd3671

SHA1
560091b2bdf518dd892016722da62fa613d5e958

SHA256
76a430452cf0bbb0e429675afd0bf1ff9bb9391f6d41dc293afd6ef06abb7c15

SHA512
7975184dadbbb612cad14d01fa03d6ece12d28d9dbd1ba5ccc05b1c10f52b866693354d25c8b667c709ad345ac4a8715ec6e425702d0e3a73d606026bcaba659

Download Submit
C:\Users\Admin\Documents\b106484eb915e4ad6df697dc1442cbff-EDITED.txt

Filesize
32B

MD5
5487dd5ec11b05c9f40df10892a2be77

SHA1
f280495646fbe745db0a59d4c4d9c4529a205321

SHA256
9dbd45db8495aeb79115856938096941222a3860c642a9c42f0c0f186683909a

SHA512
d9128a6bb1534915cc2737d64145fb0e243a5cf709b03d3703570cd3fa6d5d703e02b056b371787288225a7225a3d8f16aee0831ad30e433c2d3110121101945

Download Submit
C:\Windows\Installer\MSI38CC.tmp

Filesize
131KB

MD5
a06ba919e980d32e0ebe80ddfa099524

SHA1
2a1c0cbec1cbf5774a6d00fc3a14d2ce979026d1

SHA256
b8074d53c56f7deb5832af3894ec20a21d1162252f177984807eb30fc1152fc8

SHA512
c8be0aa247baec6c2a7061086c0bbec166099de3dd0f40e50558fb1515dbe9324662ea7c80797208e4eb2f2243c96067702edf385602773e7b3ccc36896f1d13

Download Submit
memory/576-113-0x0000000000240000-0x0000000000242000-memory.dmp

Filesize
8KB

Download
memory/1076-114-0x0000000000160000-0x0000000000162000-memory.dmp

Filesize
8KB

Download
memory/1080-49-0x0000000000B00000-0x0000000000CDE000-memory.dmp

Filesize
1.9MB

Download
memory/1080-50-0x0000000007040000-0x0000000007222000-memory.dmp

Filesize
1.9MB

Download
memory/1080-51-0x0000000000340000-0x0000000000364000-memory.dmp

Filesize
144KB

Download
memory/1080-52-0x0000000000980000-0x000000000098A000-memory.dmp

Filesize
40KB

Download
memory/1596-140-0x0000000000470000-0x000000000047C000-memory.dmp

Filesize
48KB

Download
memory/1596-121-0x0000000001190000-0x000000000136E000-memory.dmp

Filesize
1.9MB

Download
memory/1980-156-0x00000000773D0000-0x00000000774CA000-memory.dmp

Filesize
1000KB

Download
memory/1980-155-0x00000000772B0000-0x00000000773CF000-memory.dmp

Filesize
1.1MB

Download
memory/2100-54-0x0000000000B00000-0x0000000000CDE000-memory.dmp

Filesize
1.9MB

Download
memory/2888-153-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2888-149-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2888-151-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2888-152-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2888-148-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2888-146-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2888-144-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2888-154-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2888-157-0x0000000000240000-0x0000000000250000-memory.dmp

Filesize
64KB

Download
memory/2888-158-0x0000000004160000-0x000000000420E000-memory.dmp

Filesize
696KB

Download
memory/2888-159-0x0000000000460000-0x0000000000488000-memory.dmp

Filesize
160KB

Download
memory/2888-160-0x00000000005F0000-0x0000000000606000-memory.dmp

Filesize
88KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads