Analysis
-
max time kernel
146s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
15-09-2024 09:11
General
-
Target
e225fbb1197c694a002c405b7b0100c1_JaffaCakes118.exe
-
Size
632KB
-
MD5
e225fbb1197c694a002c405b7b0100c1
-
SHA1
78a2309485471ed0922bc9ae0623b0fca7f5d26d
-
SHA256
570626631a17f1a8864203810fc62b05e1bcba11f5d29ba125d276377fdeb9e9
-
SHA512
f61b16f881d57e88fab827dda15a52835038434a890c318d2994ca2773835221f96982de523a06c5369489199a38207b701db523885ce9ecb5bc5ef712a03c32
-
SSDEEP
12288:Q0I6gujHEgtd9akjGPMaDXJC2xwY2/ZpvkqrLa:Q0nguH7Z2ZJC2xfkZpvkua
Malware Config
Signatures
-
Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e225fbb1197c694a002c405b7b0100c1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e225fbb1197c694a002c405b7b0100c1_JaffaCakes118.exe"1⤵
- Modifies WinLogon for persistence
- Checks for VirtualBox DLLs, possible anti-VM trick
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB