imminent | 6ff3d035b2e8e8e4e916d812d56fc80ef208a73df53f518a8e3897d36b98587b

General

Target

ca8a20ea8d4c2138ceea59b48e0866b4_JaffaCakes118.exe
Size

648KB
MD5

ca8a20ea8d4c2138ceea59b48e0866b4
SHA1

873da3bd6e0864f7f4aef6bb9221cd6a7c6fe705
SHA256

6ff3d035b2e8e8e4e916d812d56fc80ef208a73df53f518a8e3897d36b98587b
SHA512

15f85396048d726f9be0f98aeb30bd20897c74c3963b63f6effc2d07e1f4d419f730b6affcceaf162aa9e856d2cbf51c0c66e36e2800c828509b09016e19c355
SSDEEP

6144:zXkq206D2dF/ciYI+4wvsMgeFwjdcIS77J1gMvDrcxlFRShozxSdRrZX+Uam:zXnz5iQYwjdcIsvdDLhwS5

Score

10^/10

imminent discovery persistence spyware trojan

Malware Config

Signatures

Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
trojan spyware imminent

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	ca8a20ea8d4c2138ceea59b48e0866b4_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
1936	ca8a20ea8d4c2138ceea59b48e0866b4_jaffacakes118.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "\\Microsoft\\iscilog.exe"	ca8a20ea8d4c2138ceea59b48e0866b4_jaffacakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\iscilog.exe"	ca8a20ea8d4c2138ceea59b48e0866b4_jaffacakes118.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	C:\Windows\assembly\Desktop.ini	ca8a20ea8d4c2138ceea59b48e0866b4_jaffacakes118.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	ca8a20ea8d4c2138ceea59b48e0866b4_jaffacakes118.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly	ca8a20ea8d4c2138ceea59b48e0866b4_jaffacakes118.exe
File created	C:\Windows\assembly\Desktop.ini	ca8a20ea8d4c2138ceea59b48e0866b4_jaffacakes118.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	ca8a20ea8d4c2138ceea59b48e0866b4_jaffacakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2656	PING.EXE
224	cmd.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2656	PING.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1936	ca8a20ea8d4c2138ceea59b48e0866b4_jaffacakes118.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2852	ca8a20ea8d4c2138ceea59b48e0866b4_JaffaCakes118.exe
Token: SeDebugPrivilege	1936	ca8a20ea8d4c2138ceea59b48e0866b4_jaffacakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1936	ca8a20ea8d4c2138ceea59b48e0866b4_jaffacakes118.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2852 wrote to memory of 1936	2852	ca8a20ea8d4c2138ceea59b48e0866b4_JaffaCakes118.exe	86
PID 2852 wrote to memory of 1936	2852	ca8a20ea8d4c2138ceea59b48e0866b4_JaffaCakes118.exe	86
PID 2852 wrote to memory of 224	2852	ca8a20ea8d4c2138ceea59b48e0866b4_JaffaCakes118.exe	87
PID 2852 wrote to memory of 224	2852	ca8a20ea8d4c2138ceea59b48e0866b4_JaffaCakes118.exe	87
PID 224 wrote to memory of 2656	224	cmd.exe	89
PID 224 wrote to memory of 2656	224	cmd.exe	89

C:\Users\Admin\AppData\Local\Temp\ca8a20ea8d4c2138ceea59b48e0866b4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ca8a20ea8d4c2138ceea59b48e0866b4_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2852
- C:\Users\Admin\AppData\Local\Temp\ca8a20ea8d4c2138ceea59b48e0866b4_jaffacakes118\ca8a20ea8d4c2138ceea59b48e0866b4_jaffacakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\ca8a20ea8d4c2138ceea59b48e0866b4_jaffacakes118\ca8a20ea8d4c2138ceea59b48e0866b4_jaffacakes118.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops desktop.ini file(s)
  - Drops file in Windows directory
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1936
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 1000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\ca8a20ea8d4c2138ceea59b48e0866b4_JaffaCakes118.exe"
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:224
- - C:\Windows\system32\PING.EXE
    ping 1.1.1.1 -n 1 -w 1000
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

Remote System Discovery

1

T1018

System Information Discovery

2

T1082

System Network Configuration Discovery

1

T1016

Internet Connection Discovery

1

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ca8a20ea8d4c2138ceea59b48e0866b4_jaffacakes118\ca8a20ea8d4c2138ceea59b48e0866b4_jaffacakes118.exe

Filesize
648KB

MD5
ca8a20ea8d4c2138ceea59b48e0866b4

SHA1
873da3bd6e0864f7f4aef6bb9221cd6a7c6fe705

SHA256
6ff3d035b2e8e8e4e916d812d56fc80ef208a73df53f518a8e3897d36b98587b

SHA512
15f85396048d726f9be0f98aeb30bd20897c74c3963b63f6effc2d07e1f4d419f730b6affcceaf162aa9e856d2cbf51c0c66e36e2800c828509b09016e19c355

Download Submit
C:\Users\Admin\AppData\Roaming\Imminent\Path.dat

Filesize
52B

MD5
16becb98e228a31d541de78dda5bfdfb

SHA1
6de9bfd466e958cfa482d1fc50ed4ba8f3897532

SHA256
43997393dc669976a78d434605609061209cf5ecc4aad10a81de5d83d9309575

SHA512
3bcaecef18fa815e94faed88c3f92915f2663228760aeb4db7f16805e4da35820959d9903c0fe36793d547386395e44397985f5b477c1bb42c5650c3846bf60e

Download Submit
memory/1936-25-0x0000000000F60000-0x0000000000F6E000-memory.dmp

Filesize
56KB

Download
memory/1936-21-0x00007FF9FAD90000-0x00007FF9FB731000-memory.dmp

Filesize
9.6MB

Download
memory/1936-41-0x00007FF9FAD90000-0x00007FF9FB731000-memory.dmp

Filesize
9.6MB

Download
memory/1936-38-0x000000001B840000-0x000000001B856000-memory.dmp

Filesize
88KB

Download
memory/1936-37-0x000000001B7E0000-0x000000001B7EC000-memory.dmp

Filesize
48KB

Download
memory/1936-22-0x00007FF9FAD90000-0x00007FF9FB731000-memory.dmp

Filesize
9.6MB

Download
memory/1936-19-0x00007FF9FAD90000-0x00007FF9FB731000-memory.dmp

Filesize
9.6MB

Download
memory/2852-20-0x00007FF9FAD90000-0x00007FF9FB731000-memory.dmp

Filesize
9.6MB

Download
memory/2852-4-0x000000001B690000-0x000000001B6F0000-memory.dmp

Filesize
384KB

Download
memory/2852-2-0x00007FF9FAD90000-0x00007FF9FB731000-memory.dmp

Filesize
9.6MB

Download
memory/2852-0-0x00007FF9FB045000-0x00007FF9FB046000-memory.dmp

Filesize
4KB

Download
memory/2852-1-0x000000001B580000-0x000000001B626000-memory.dmp

Filesize
664KB

Download
memory/2852-6-0x000000001C270000-0x000000001C73E000-memory.dmp

Filesize
4.8MB

Download
memory/2852-5-0x000000001B630000-0x000000001B658000-memory.dmp

Filesize
160KB

Download
memory/2852-3-0x00007FF9FAD90000-0x00007FF9FB731000-memory.dmp

Filesize
9.6MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads