Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
18-06-2024 08:42
General
-
Target
bad10e7a73dc3f07ccfc1031b4be97dc_JaffaCakes118.exe
-
Size
206KB
-
MD5
bad10e7a73dc3f07ccfc1031b4be97dc
-
SHA1
200edd71a5ab8c08fc0542b61bd18943eefc59bb
-
SHA256
c809e2e044199a760b4b82f46e0b91eccd1868a8ecdfd4b46d0aab13e97dd5c1
-
SHA512
ab1a1274b0a98b6029369fcd49ece52d8f5ad049e15e4c06fca6ab91cf8447fd5f692412b71819e29b08494c0236b925e3dfea2de33259a211a70f9ccceecff5
-
SSDEEP
3072:imLGeqioyN51MpjgPsoAbh2WtwAeyK4QupNwyb5O0koHy930n1Fb/nbgoA:qeTV4pjgk3F1iAy4fo61q9I/
Malware Config
Signatures
-
Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Drops desktop.ini file(s) 2 IoCs
-
Drops file in Windows directory 3 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\bad10e7a73dc3f07ccfc1031b4be97dc_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\bad10e7a73dc3f07ccfc1031b4be97dc_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
59B
MD522f3c2851fecaa44e84ce97535507dbf
SHA1766f3c7511d541159fa56b5c63eea98e2bdc52e0
SHA256bcec886ba638ba8e18660953a497f1c5bcfeaa924cfc2d4a39a4efdcb7297087
SHA512c54dddc1596195e79b8ef2797b35756282f6e4633a862c14db4a935969a85354274553d2040943d59342a64e327f365ca83d8fc578c33bb55c3e37cd5a5b5a3c
-
Filesize
4.8MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
376KB
-
Filesize
160KB
-
Filesize
4KB
-
Filesize
56KB
-
Filesize
664KB
-
Filesize
9.6MB
-
Filesize
4KB
-
Filesize
9.6MB
-
Filesize
48KB
-
Filesize
88KB