Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12-06-2024 23:48

General

  • Target

    a2ff9b452041a6ff6097db779da26d70_JaffaCakes118.exe

  • Size

    455KB

  • MD5

    a2ff9b452041a6ff6097db779da26d70

  • SHA1

    d9fb90605868c19cdc91c556fb9abfcd09fcdff5

  • SHA256

    c4d9db58c442972cbcb09632bd06b477c6a33f3827a00ac0ec2baeb6a0e6e9cc

  • SHA512

    2c2012fb5821a26d3aa4f5bb645d087978b846ddecd87cc5c4ece039dbac011f44bcf263fbfc383f5546d906391c9c5d5af7e81d7aa92427832de107505c3867

  • SSDEEP

    12288:bRVbfvJSlmOPufGjKH2KcDx/2aTxryFM0v+YXO:bfNonjKH2KcF/RM2

Score
10/10

Malware Config

Signatures

  • Imminent RAT

    Remote-access trojan based on Imminent Monitor remote admin software.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a2ff9b452041a6ff6097db779da26d70_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\a2ff9b452041a6ff6097db779da26d70_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:2216
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe" /logtoconsole=false /logfile= /u "C:\Users\Admin\AppData\Local\Temp\a2ff9b452041a6ff6097db779da26d70_JaffaCakes118.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4900
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\UwAqxT" /XML "C:\Users\Admin\AppData\Local\Temp\tmpDBE9.tmp"
        3⤵
        • Creates scheduled task(s)
        PID:3200
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
        3⤵
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:5084
  • C:\Windows\system32\wbem\WmiApSrv.exe
    C:\Windows\system32\wbem\WmiApSrv.exe
    1⤵
      PID:2996

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\installutil.exe.log

      Filesize

      1KB

      MD5

      c7b95e5f692958978a8d6a979d74f6c8

      SHA1

      fed2d45865370bcafb126ca5ac997f7aeeb8834e

      SHA256

      47a41d43257d9d323c83606aa2c49832f458624e018fcd29c67e452cd8c49029

      SHA512

      227e9bfde31acabc6813e822af62bc5975f852d98f95be266e1f23257b4fb5440f9457cbf0d2e82baf2a32ad4559aee4812857a4235aabe7f112ece5619bfbd8

    • C:\Users\Admin\AppData\Local\Temp\tmpDBE9.tmp

      Filesize

      1KB

      MD5

      1486c0434bb411c86087fa3f8249a966

      SHA1

      f3da7dd2674610dc46c76b4eb7aa9f80ea81d3cd

      SHA256

      f0fd04db6633f929948bfdb4d63b54043e76229ace4fb3ea9425e0b4fd103137

      SHA512

      0ffcdb4aae72d6692dfdb03c82dd7c96cdd066680a843cc1d20f0a9a96682d7ba28a6f98a493faa6c3ad6279bcb855a6b09a1914da1b56cca9b84377ef2b128b

    • memory/2216-0-0x0000000075282000-0x0000000075283000-memory.dmp

      Filesize

      4KB

    • memory/2216-1-0x0000000075280000-0x0000000075831000-memory.dmp

      Filesize

      5.7MB

    • memory/2216-2-0x0000000075280000-0x0000000075831000-memory.dmp

      Filesize

      5.7MB

    • memory/2216-4-0x0000000075280000-0x0000000075831000-memory.dmp

      Filesize

      5.7MB

    • memory/4900-13-0x0000000005A30000-0x0000000005A8E000-memory.dmp

      Filesize

      376KB

    • memory/4900-5-0x00000000003B0000-0x00000000003BC000-memory.dmp

      Filesize

      48KB

    • memory/4900-9-0x0000000075130000-0x00000000758E0000-memory.dmp

      Filesize

      7.7MB

    • memory/4900-10-0x0000000004E30000-0x0000000004ECC000-memory.dmp

      Filesize

      624KB

    • memory/4900-11-0x0000000005480000-0x0000000005A24000-memory.dmp

      Filesize

      5.6MB

    • memory/4900-12-0x0000000004F70000-0x0000000005002000-memory.dmp

      Filesize

      584KB

    • memory/4900-7-0x0000000075130000-0x00000000758E0000-memory.dmp

      Filesize

      7.7MB

    • memory/4900-14-0x0000000075130000-0x00000000758E0000-memory.dmp

      Filesize

      7.7MB

    • memory/4900-6-0x0000000004C70000-0x0000000004C8A000-memory.dmp

      Filesize

      104KB

    • memory/4900-8-0x0000000004DB0000-0x0000000004E28000-memory.dmp

      Filesize

      480KB

    • memory/4900-23-0x0000000075130000-0x00000000758E0000-memory.dmp

      Filesize

      7.7MB

    • memory/5084-20-0x0000000000400000-0x0000000000456000-memory.dmp

      Filesize

      344KB

    • memory/5084-25-0x0000000075130000-0x00000000758E0000-memory.dmp

      Filesize

      7.7MB

    • memory/5084-24-0x0000000002880000-0x0000000002890000-memory.dmp

      Filesize

      64KB

    • memory/5084-27-0x0000000004E80000-0x0000000004EA8000-memory.dmp

      Filesize

      160KB

    • memory/5084-26-0x0000000004DD0000-0x0000000004E7E000-memory.dmp

      Filesize

      696KB

    • memory/5084-28-0x0000000005F80000-0x0000000005FE6000-memory.dmp

      Filesize

      408KB

    • memory/5084-29-0x00000000065A0000-0x00000000065B8000-memory.dmp

      Filesize

      96KB

    • memory/5084-30-0x00000000065F0000-0x0000000006606000-memory.dmp

      Filesize

      88KB

    • memory/5084-31-0x0000000006760000-0x000000000676A000-memory.dmp

      Filesize

      40KB

    • memory/5084-37-0x0000000075130000-0x00000000758E0000-memory.dmp

      Filesize

      7.7MB