Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

a2ff9b4520...18.exe

windows7-x64

10

a2ff9b4520...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/06/2024, 23:48 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    a2ff9b452041a6ff6097db779da26d70_JaffaCakes118.exe

  • Size

    455KB

  • MD5

    a2ff9b452041a6ff6097db779da26d70

  • SHA1

    d9fb90605868c19cdc91c556fb9abfcd09fcdff5

  • SHA256

    c4d9db58c442972cbcb09632bd06b477c6a33f3827a00ac0ec2baeb6a0e6e9cc

  • SHA512

    2c2012fb5821a26d3aa4f5bb645d087978b846ddecd87cc5c4ece039dbac011f44bcf263fbfc383f5546d906391c9c5d5af7e81d7aa92427832de107505c3867

  • SSDEEP

    12288:bRVbfvJSlmOPufGjKH2KcDx/2aTxryFM0v+YXO:bfNonjKH2KcF/RM2

Score
10/10
imminentspywaretrojan

Malware Config

Signatures

  • Imminent RAT

    Remote-access trojan based on Imminent Monitor remote admin software.

    trojanspywareimminent
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a2ff9b452041a6ff6097db779da26d70_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\a2ff9b452041a6ff6097db779da26d70_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:2216
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe" /logtoconsole=false /logfile= /u "C:\Users\Admin\AppData\Local\Temp\a2ff9b452041a6ff6097db779da26d70_JaffaCakes118.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4900
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\UwAqxT" /XML "C:\Users\Admin\AppData\Local\Temp\tmpDBE9.tmp"
        3⤵
        • Creates scheduled task(s)
        PID:3200
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
        3⤵
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:5084
  • C:\Windows\system32\wbem\WmiApSrv.exe
    C:\Windows\system32\wbem\WmiApSrv.exe
    1⤵
      PID:2996

    Network

    • flag-us
      DNS
      multi100.spdns.de
      installutil.exe
      Remote address:
      8.8.8.8:53
      Request
      multi100.spdns.de
      IN A
    • flag-us
      DNS
      multi100.spdns.de
      installutil.exe
      Remote address:
      8.8.8.8:53
      Request
      multi100.spdns.de
      IN A
    • flag-us
      DNS
      multi100.spdns.de
      installutil.exe
      Remote address:
      8.8.8.8:53
      Request
      multi100.spdns.de
      IN A
    • flag-us
      DNS
      multi100.spdns.de
      installutil.exe
      Remote address:
      8.8.8.8:53
      Request
      multi100.spdns.de
      IN A
    • flag-us
      DNS
      multi100.spdns.de
      installutil.exe
      Remote address:
      8.8.8.8:53
      Request
      multi100.spdns.de
      IN A
    • flag-us
      DNS
      multi100.spdns.de
      installutil.exe
      Remote address:
      8.8.8.8:53
      Request
      multi100.spdns.de
      IN A
    • flag-us
      DNS
      multi100.spdns.de
      installutil.exe
      Remote address:
      8.8.8.8:53
      Request
      multi100.spdns.de
      IN A
    • flag-us
      DNS
      multi100.spdns.de
      installutil.exe
      Remote address:
      8.8.8.8:53
      Request
      multi100.spdns.de
      IN A
    • flag-us
      DNS
      multi100.spdns.de
      installutil.exe
      Remote address:
      8.8.8.8:53
      Request
      multi100.spdns.de
      IN A
    • flag-us
      DNS
      multi100.spdns.de
      installutil.exe
      Remote address:
      8.8.8.8:53
      Request
      multi100.spdns.de
      IN A
    • flag-us
      DNS
      multi100.spdns.de
      installutil.exe
      Remote address:
      8.8.8.8:53
      Request
      multi100.spdns.de
      IN A
    • flag-us
      DNS
      multi100.spdns.de
      installutil.exe
      Remote address:
      8.8.8.8:53
      Request
      multi100.spdns.de
      IN A
    • flag-us
      DNS
      multi100.spdns.de
      installutil.exe
      Remote address:
      8.8.8.8:53
      Request
      multi100.spdns.de
      IN A
    • flag-us
      DNS
      multi100.spdns.de
      installutil.exe
      Remote address:
      8.8.8.8:53
      Request
      multi100.spdns.de
      IN A
    • flag-us
      DNS
      multi100.spdns.de
      installutil.exe
      Remote address:
      8.8.8.8:53
      Request
      multi100.spdns.de
      IN A
    • flag-us
      DNS
      multi100.spdns.de
      installutil.exe
      Remote address:
      8.8.8.8:53
      Request
      multi100.spdns.de
      IN A
    • flag-us
      DNS
      multi100.spdns.de
      installutil.exe
      Remote address:
      8.8.8.8:53
      Request
      multi100.spdns.de
      IN A
    • flag-us
      DNS
      multi100.spdns.de
      installutil.exe
      Remote address:
      8.8.8.8:53
      Request
      multi100.spdns.de
      IN A
    • flag-us
      DNS
      multi100.spdns.de
      installutil.exe
      Remote address:
      8.8.8.8:53
      Request
      multi100.spdns.de
      IN A
    • flag-us
      DNS
      multi100.spdns.de
      installutil.exe
      Remote address:
      8.8.8.8:53
      Request
      multi100.spdns.de
      IN A
    • flag-us
      DNS
      multi100.spdns.de
      installutil.exe
      Remote address:
      8.8.8.8:53
      Request
      multi100.spdns.de
      IN A
    • flag-us
      DNS
      multi100.spdns.de
      installutil.exe
      Remote address:
      8.8.8.8:53
      Request
      multi100.spdns.de
      IN A
    • flag-us
      DNS
      multi100.spdns.de
      installutil.exe
      Remote address:
      8.8.8.8:53
      Request
      multi100.spdns.de
      IN A
    • flag-us
      DNS
      multi100.spdns.de
      installutil.exe
      Remote address:
      8.8.8.8:53
      Request
      multi100.spdns.de
      IN A
    • flag-us
      DNS
      multi100.spdns.de
      installutil.exe
      Remote address:
      8.8.8.8:53
      Request
      multi100.spdns.de
      IN A
    • flag-us
      DNS
      multi100.spdns.de
      installutil.exe
      Remote address:
      8.8.8.8:53
      Request
      multi100.spdns.de
      IN A
    • flag-us
      DNS
      multi100.spdns.de
      installutil.exe
      Remote address:
      8.8.8.8:53
      Request
      multi100.spdns.de
      IN A
    • flag-us
      DNS
      multi100.spdns.de
      installutil.exe
      Remote address:
      8.8.8.8:53
      Request
      multi100.spdns.de
      IN A
    • flag-us
      DNS
      multi100.spdns.de
      installutil.exe
      Remote address:
      8.8.8.8:53
      Request
      multi100.spdns.de
      IN A
    • flag-us
      DNS
      multi100.spdns.de
      installutil.exe
      Remote address:
      8.8.8.8:53
      Request
      multi100.spdns.de
      IN A
    • flag-us
      DNS
      multi100.spdns.de
      installutil.exe
      Remote address:
      8.8.8.8:53
      Request
      multi100.spdns.de
      IN A
    • flag-us
      DNS
      multi100.spdns.de
      installutil.exe
      Remote address:
      8.8.8.8:53
      Request
      multi100.spdns.de
      IN A
    • flag-us
      DNS
      multi100.spdns.de
      installutil.exe
      Remote address:
      8.8.8.8:53
      Request
      multi100.spdns.de
      IN A
    • flag-us
      DNS
      multi100.spdns.de
      installutil.exe
      Remote address:
      8.8.8.8:53
      Request
      multi100.spdns.de
      IN A
    • flag-us
      DNS
      multi100.spdns.de
      installutil.exe
      Remote address:
      8.8.8.8:53
      Request
      multi100.spdns.de
      IN A
    • flag-us
      DNS
      multi100.spdns.de
      installutil.exe
      Remote address:
      8.8.8.8:53
      Request
      multi100.spdns.de
      IN A
    • flag-us
      DNS
      multi100.spdns.de
      installutil.exe
      Remote address:
      8.8.8.8:53
      Request
      multi100.spdns.de
      IN A
    • flag-us
      DNS
      multi100.spdns.de
      installutil.exe
      Remote address:
      8.8.8.8:53
      Request
      multi100.spdns.de
      IN A
    • flag-us
      DNS
      multi100.spdns.de
      installutil.exe
      Remote address:
      8.8.8.8:53
      Request
      multi100.spdns.de
      IN A
    • flag-us
      DNS
      multi100.spdns.de
      installutil.exe
      Remote address:
      8.8.8.8:53
      Request
      multi100.spdns.de
      IN A
    • flag-us
      DNS
      multi100.spdns.de
      installutil.exe
      Remote address:
      8.8.8.8:53
      Request
      multi100.spdns.de
      IN A
    • flag-us
      DNS
      multi100.spdns.de
      installutil.exe
      Remote address:
      8.8.8.8:53
      Request
      multi100.spdns.de
      IN A
    • flag-us
      DNS
      multi100.spdns.de
      installutil.exe
      Remote address:
      8.8.8.8:53
      Request
      multi100.spdns.de
      IN A
    • flag-us
      DNS
      multi100.spdns.de
      installutil.exe
      Remote address:
      8.8.8.8:53
      Request
      multi100.spdns.de
      IN A
    • flag-us
      DNS
      multi100.spdns.de
      installutil.exe
      Remote address:
      8.8.8.8:53
      Request
      multi100.spdns.de
      IN A
    No results found
    • 8.8.8.8:53
      multi100.spdns.de
      dns
      installutil.exe
      315 B
       5

      DNS Request

      multi100.spdns.de

      DNS Request

      multi100.spdns.de

      DNS Request

      multi100.spdns.de

      DNS Request

      multi100.spdns.de

      DNS Request

      multi100.spdns.de

    • 8.8.8.8:53
      multi100.spdns.de
      dns
      installutil.exe
      315 B
       5

      DNS Request

      multi100.spdns.de

      DNS Request

      multi100.spdns.de

      DNS Request

      multi100.spdns.de

      DNS Request

      multi100.spdns.de

      DNS Request

      multi100.spdns.de

    • 8.8.8.8:53
      multi100.spdns.de
      dns
      installutil.exe
      315 B
       5

      DNS Request

      multi100.spdns.de

      DNS Request

      multi100.spdns.de

      DNS Request

      multi100.spdns.de

      DNS Request

      multi100.spdns.de

      DNS Request

      multi100.spdns.de

    • 8.8.8.8:53
      multi100.spdns.de
      dns
      installutil.exe
      315 B
       5

      DNS Request

      multi100.spdns.de

      DNS Request

      multi100.spdns.de

      DNS Request

      multi100.spdns.de

      DNS Request

      multi100.spdns.de

      DNS Request

      multi100.spdns.de

    • 8.8.8.8:53
      multi100.spdns.de
      dns
      installutil.exe
      315 B
       5

      DNS Request

      multi100.spdns.de

      DNS Request

      multi100.spdns.de

      DNS Request

      multi100.spdns.de

      DNS Request

      multi100.spdns.de

      DNS Request

      multi100.spdns.de

    • 8.8.8.8:53
      multi100.spdns.de
      dns
      installutil.exe
      315 B
       5

      DNS Request

      multi100.spdns.de

      DNS Request

      multi100.spdns.de

      DNS Request

      multi100.spdns.de

      DNS Request

      multi100.spdns.de

      DNS Request

      multi100.spdns.de

    • 8.8.8.8:53
      multi100.spdns.de
      dns
      installutil.exe
      315 B
       5

      DNS Request

      multi100.spdns.de

      DNS Request

      multi100.spdns.de

      DNS Request

      multi100.spdns.de

      DNS Request

      multi100.spdns.de

      DNS Request

      multi100.spdns.de

    • 8.8.8.8:53
      multi100.spdns.de
      dns
      installutil.exe
      315 B
       5

      DNS Request

      multi100.spdns.de

      DNS Request

      multi100.spdns.de

      DNS Request

      multi100.spdns.de

      DNS Request

      multi100.spdns.de

      DNS Request

      multi100.spdns.de

    • 8.8.8.8:53
      multi100.spdns.de
      dns
      installutil.exe
      315 B
       5

      DNS Request

      multi100.spdns.de

      DNS Request

      multi100.spdns.de

      DNS Request

      multi100.spdns.de

      DNS Request

      multi100.spdns.de

      DNS Request

      multi100.spdns.de

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\installutil.exe.log
      Filesize

      1KB

      MD5

      c7b95e5f692958978a8d6a979d74f6c8

      SHA1

      fed2d45865370bcafb126ca5ac997f7aeeb8834e

      SHA256

      47a41d43257d9d323c83606aa2c49832f458624e018fcd29c67e452cd8c49029

      SHA512

      227e9bfde31acabc6813e822af62bc5975f852d98f95be266e1f23257b4fb5440f9457cbf0d2e82baf2a32ad4559aee4812857a4235aabe7f112ece5619bfbd8

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\tmpDBE9.tmp
      Filesize

      1KB

      MD5

      1486c0434bb411c86087fa3f8249a966

      SHA1

      f3da7dd2674610dc46c76b4eb7aa9f80ea81d3cd

      SHA256

      f0fd04db6633f929948bfdb4d63b54043e76229ace4fb3ea9425e0b4fd103137

      SHA512

      0ffcdb4aae72d6692dfdb03c82dd7c96cdd066680a843cc1d20f0a9a96682d7ba28a6f98a493faa6c3ad6279bcb855a6b09a1914da1b56cca9b84377ef2b128b

      Download Submit

    • memory/2216-0-0x0000000075282000-0x0000000075283000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2216-1-0x0000000075280000-0x0000000075831000-memory.dmp

      Filesize

      5.7MB

      Download

    • memory/2216-2-0x0000000075280000-0x0000000075831000-memory.dmp

      Filesize

      5.7MB

      Download

    • memory/2216-4-0x0000000075280000-0x0000000075831000-memory.dmp

      Filesize

      5.7MB

      Download

    • memory/4900-13-0x0000000005A30000-0x0000000005A8E000-memory.dmp

      Filesize

      376KB

      Download

    • memory/4900-5-0x00000000003B0000-0x00000000003BC000-memory.dmp

      Filesize

      48KB

      Download

    • memory/4900-9-0x0000000075130000-0x00000000758E0000-memory.dmp

      Filesize

      7.7MB

      Download

    • memory/4900-10-0x0000000004E30000-0x0000000004ECC000-memory.dmp

      Filesize

      624KB

      Download

    • memory/4900-11-0x0000000005480000-0x0000000005A24000-memory.dmp

      Filesize

      5.6MB

      Download

    • memory/4900-12-0x0000000004F70000-0x0000000005002000-memory.dmp

      Filesize

      584KB

      Download

    • memory/4900-7-0x0000000075130000-0x00000000758E0000-memory.dmp

      Filesize

      7.7MB

      Download

    • memory/4900-14-0x0000000075130000-0x00000000758E0000-memory.dmp

      Filesize

      7.7MB

      Download

    • memory/4900-6-0x0000000004C70000-0x0000000004C8A000-memory.dmp

      Filesize

      104KB

      Download

    • memory/4900-8-0x0000000004DB0000-0x0000000004E28000-memory.dmp

      Filesize

      480KB

      Download

    • memory/4900-23-0x0000000075130000-0x00000000758E0000-memory.dmp

      Filesize

      7.7MB

      Download

    • memory/5084-20-0x0000000000400000-0x0000000000456000-memory.dmp

      Filesize

      344KB

      Download

    • memory/5084-25-0x0000000075130000-0x00000000758E0000-memory.dmp

      Filesize

      7.7MB

      Download

    • memory/5084-24-0x0000000002880000-0x0000000002890000-memory.dmp

      Filesize

      64KB

      Download

    • memory/5084-27-0x0000000004E80000-0x0000000004EA8000-memory.dmp

      Filesize

      160KB

      Download

    • memory/5084-26-0x0000000004DD0000-0x0000000004E7E000-memory.dmp

      Filesize

      696KB

      Download

    • memory/5084-28-0x0000000005F80000-0x0000000005FE6000-memory.dmp

      Filesize

      408KB

      Download

    • memory/5084-29-0x00000000065A0000-0x00000000065B8000-memory.dmp

      Filesize

      96KB

      Download

    • memory/5084-30-0x00000000065F0000-0x0000000006606000-memory.dmp

      Filesize

      88KB

      Download

    • memory/5084-31-0x0000000006760000-0x000000000676A000-memory.dmp

      Filesize

      40KB

      Download

    • memory/5084-37-0x0000000075130000-0x00000000758E0000-memory.dmp

      Filesize

      7.7MB

      Download

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.