Overview

overview

10

Static

static

3

f7699f2954...18.exe

windows7-x64

10

f7699f2954...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    26-09-2024 03:00

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    f7699f2954ca4a8fc483fc909d5e63de_JaffaCakes118.exe

  • Size

    4.0MB

  • MD5

    f7699f2954ca4a8fc483fc909d5e63de

  • SHA1

    3a31a9060ba091f4fe58b1e8ccacee93c8d5f5e1

  • SHA256

    8d74fdc45bdb6c5acf3e54e3828944bb270b6c9e46dd44f0a0932ee85ccfa5d9

  • SHA512

    2a2dccad1b1ff2aabdd7f8c1bb6158b1a32b381a0cd5f13165d0ae46d7129bfc5d39d7c1cc5508d948bd71be0f0a7b21968d1894dc62eb03161ff918847fe434

  • SSDEEP

    192:NfEUdP85+BJBalIub/8nkOCkkN4DClW2QFbwuQIGxLOQ6r4J1LYX5eMKnq4gwkaq:egBJBalIQ/8qn3PuPL

Score
10/10
imminentdiscoverypersistencespywaretrojan

Malware Config

Signatures

  • Imminent RAT

    Remote-access trojan based on Imminent Monitor remote admin software.

    trojanspywareimminent
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f7699f2954ca4a8fc483fc909d5e63de_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\f7699f2954ca4a8fc483fc909d5e63de_JaffaCakes118.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2212
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      2⤵
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2360
      • C:\Windows\SysWOW64\taskmgr.exe
        "C:\Windows\System32\taskmgr.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:3052
  • C:\Windows\system32\wbem\WmiApSrv.exe
    C:\Windows\system32\wbem\WmiApSrv.exe
    1⤵
      PID:852

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\Imminent\Path.dat
      Filesize

      52B

      MD5

      06f513fe92fd68a11fc4b6926d51cf47

      SHA1

      f56e998fea5befa4ac1f2313eb5db24d6c6c0d0a

      SHA256

      0296eaf97f831b705512a9b669b354a0889b16f44f082ecf073b69c25b77aa42

      SHA512

      79f668c917d8e66e6f3dcd298a7429a6be7a9e6087b8c39c8d3e6de071b8fa05b29f41b0f764ecf7de12142c13bfe197efa9cb144ef2cc2e08a1c11080ed23dc

      Download Submit

    • memory/2212-2-0x0000000000470000-0x0000000000484000-memory.dmp

      Filesize

      80KB

      Download

    • memory/2212-1-0x00000000002C0000-0x0000000000326000-memory.dmp

      Filesize

      408KB

      Download

    • memory/2212-0-0x0000000000D70000-0x000000000116C000-memory.dmp

      Filesize

      4.0MB

      Download

    • memory/2360-8-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2360-14-0x0000000000400000-0x0000000000456000-memory.dmp

      Filesize

      344KB

      Download

    • memory/2360-12-0x0000000000400000-0x0000000000456000-memory.dmp

      Filesize

      344KB

      Download

    • memory/2360-10-0x0000000000400000-0x0000000000456000-memory.dmp

      Filesize

      344KB

      Download

    • memory/2360-5-0x0000000000400000-0x0000000000456000-memory.dmp

      Filesize

      344KB

      Download

    • memory/2360-7-0x0000000000400000-0x0000000000456000-memory.dmp

      Filesize

      344KB

      Download

    • memory/2360-6-0x0000000000400000-0x0000000000456000-memory.dmp

      Filesize

      344KB

      Download

    • memory/2360-15-0x0000000000260000-0x0000000000270000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2360-16-0x00000000051F0000-0x000000000529E000-memory.dmp

      Filesize

      696KB

      Download

    • memory/2360-17-0x00000000005F0000-0x0000000000618000-memory.dmp

      Filesize

      160KB

      Download

    • memory/2360-20-0x0000000000AC0000-0x0000000000AD6000-memory.dmp

      Filesize

      88KB

      Download

    • memory/2360-4-0x0000000000400000-0x0000000000456000-memory.dmp

      Filesize

      344KB

      Download