Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15-06-2024 14:38

General

  • Target

    aee5704ab8e1ef4484caef048a2e286f_JaffaCakes118.exe

  • Size

    652KB

  • MD5

    aee5704ab8e1ef4484caef048a2e286f

  • SHA1

    e023f6678b315e5b48beeaa0f3239adc15aaf59f

  • SHA256

    d07f8aa03c96baaacb17564a7bd9d8be6b7effb347a1a98e1ea201a528e4ff8f

  • SHA512

    184645be06e5945d09c1c0bb0756e4943757d44db203928e025c6f5147c516123d9fc2221f1cd53e684edf170a39f7c3bfc58ba20a7824a21a77d21d03be36ef

  • SSDEEP

    12288:2lAb5lthGT76dsIqVpYO+NyEcQQ+9OoZyXTGMFTBJPfiIR:2azrGT7muSiEc+9OoGG4pqI

Malware Config

Signatures

  • Imminent RAT

    Remote-access trojan based on Imminent Monitor remote admin software.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\aee5704ab8e1ef4484caef048a2e286f_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\aee5704ab8e1ef4484caef048a2e286f_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1004
    • C:\Users\Admin\AppData\Local\Temp\aee5704ab8e1ef4484caef048a2e286f_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\aee5704ab8e1ef4484caef048a2e286f_JaffaCakes118.exe"
      2⤵
      • Checks computer location settings
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2012
      • C:\Users\Admin\AppData\Local\Temp\aee5704ab8e1ef4484caef048a2e286f_jaffacakes118\aee5704ab8e1ef4484caef048a2e286f_jaffacakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\aee5704ab8e1ef4484caef048a2e286f_jaffacakes118\aee5704ab8e1ef4484caef048a2e286f_jaffacakes118.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1092
        • C:\Users\Admin\AppData\Local\Temp\aee5704ab8e1ef4484caef048a2e286f_jaffacakes118\aee5704ab8e1ef4484caef048a2e286f_jaffacakes118.exe
          "C:\Users\Admin\AppData\Local\Temp\aee5704ab8e1ef4484caef048a2e286f_jaffacakes118\aee5704ab8e1ef4484caef048a2e286f_jaffacakes118.exe"
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:4660
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 1000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\aee5704ab8e1ef4484caef048a2e286f_JaffaCakes118.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2304
        • C:\Windows\SysWOW64\PING.EXE
          ping 1.1.1.1 -n 1 -w 1000
          4⤵
          • Runs ping.exe
          PID:1904
  • C:\Windows\system32\wbem\WmiApSrv.exe
    C:\Windows\system32\wbem\WmiApSrv.exe
    1⤵
      PID:2752

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\aee5704ab8e1ef4484caef048a2e286f_jaffacakes118.exe.log

      Filesize

      1KB

      MD5

      ac2d896801634ffc30f4f3d578aabddd

      SHA1

      9725e8599855b423c8da0b26ad73f189bfad915e

      SHA256

      52b421597cdd56b743bcc4e8cbe7df9724014b2703532cb5c7c94e037da129dd

      SHA512

      c5f60e9f7c1e6289234a8627f2037e87acf2260d340322451fc5b988c31832bf80e20da901cc2a9da6639206d9d003162a7901f96b816dc4125220873321ae42

    • C:\Users\Admin\AppData\Local\Temp\aee5704ab8e1ef4484caef048a2e286f_jaffacakes118\aee5704ab8e1ef4484caef048a2e286f_jaffacakes118.exe

      Filesize

      652KB

      MD5

      aee5704ab8e1ef4484caef048a2e286f

      SHA1

      e023f6678b315e5b48beeaa0f3239adc15aaf59f

      SHA256

      d07f8aa03c96baaacb17564a7bd9d8be6b7effb347a1a98e1ea201a528e4ff8f

      SHA512

      184645be06e5945d09c1c0bb0756e4943757d44db203928e025c6f5147c516123d9fc2221f1cd53e684edf170a39f7c3bfc58ba20a7824a21a77d21d03be36ef

    • C:\Users\Admin\AppData\Roaming\Imminent\Path.dat

      Filesize

      56B

      MD5

      c21ff3751aeec4506de0e2b2bec7cf66

      SHA1

      f7ecfd2d361c287233d4480f4982d815cde28832

      SHA256

      e7723b9bd121f5246641ae6736675c2f188e276c886e4cec6b405c92e10a5f36

      SHA512

      1615e7d1e0a965c9a988a064e56e848211592d5ba5eceed513f586f704b7909da4dc6cb54a045fb456983796060058af13cf2bf2b23ba6e04884a14cef877af6

    • memory/1004-7-0x0000000004FE0000-0x0000000004FEA000-memory.dmp

      Filesize

      40KB

    • memory/1004-3-0x0000000005BD0000-0x0000000006174000-memory.dmp

      Filesize

      5.6MB

    • memory/1004-5-0x0000000005720000-0x000000000573E000-memory.dmp

      Filesize

      120KB

    • memory/1004-6-0x0000000074E40000-0x00000000755F0000-memory.dmp

      Filesize

      7.7MB

    • memory/1004-0-0x0000000074E4E000-0x0000000074E4F000-memory.dmp

      Filesize

      4KB

    • memory/1004-8-0x0000000074E4E000-0x0000000074E4F000-memory.dmp

      Filesize

      4KB

    • memory/1004-9-0x0000000074E40000-0x00000000755F0000-memory.dmp

      Filesize

      7.7MB

    • memory/1004-10-0x0000000009660000-0x00000000096FC000-memory.dmp

      Filesize

      624KB

    • memory/1004-1-0x0000000000B00000-0x0000000000BAC000-memory.dmp

      Filesize

      688KB

    • memory/1004-4-0x0000000005B20000-0x0000000005BB2000-memory.dmp

      Filesize

      584KB

    • memory/1004-2-0x0000000005500000-0x0000000005592000-memory.dmp

      Filesize

      584KB

    • memory/1004-15-0x0000000074E40000-0x00000000755F0000-memory.dmp

      Filesize

      7.7MB

    • memory/1092-33-0x0000000074E40000-0x00000000755F0000-memory.dmp

      Filesize

      7.7MB

    • memory/1092-35-0x0000000074E40000-0x00000000755F0000-memory.dmp

      Filesize

      7.7MB

    • memory/1092-39-0x0000000074E40000-0x00000000755F0000-memory.dmp

      Filesize

      7.7MB

    • memory/1092-36-0x0000000074E40000-0x00000000755F0000-memory.dmp

      Filesize

      7.7MB

    • memory/2012-20-0x0000000007D40000-0x0000000007D58000-memory.dmp

      Filesize

      96KB

    • memory/2012-16-0x0000000074E40000-0x00000000755F0000-memory.dmp

      Filesize

      7.7MB

    • memory/2012-13-0x0000000074E40000-0x00000000755F0000-memory.dmp

      Filesize

      7.7MB

    • memory/2012-14-0x00000000014D0000-0x00000000014E0000-memory.dmp

      Filesize

      64KB

    • memory/2012-34-0x0000000074E40000-0x00000000755F0000-memory.dmp

      Filesize

      7.7MB

    • memory/2012-17-0x00000000055F0000-0x000000000569E000-memory.dmp

      Filesize

      696KB

    • memory/2012-19-0x0000000007740000-0x00000000077A6000-memory.dmp

      Filesize

      408KB

    • memory/2012-18-0x0000000003000000-0x0000000003028000-memory.dmp

      Filesize

      160KB

    • memory/2012-11-0x0000000000400000-0x0000000000456000-memory.dmp

      Filesize

      344KB

    • memory/4660-42-0x00000000078F0000-0x0000000007906000-memory.dmp

      Filesize

      88KB