Analysis
- max time kernel
147s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
29/03/2024, 17:49
General
- Target 28b8413419b5656cecb272e07079b047_JaffaCakes118.exe
- Size 5.9MB
- Sample240329-weabqsef57
- SHA256 9a19b05e6b1086729de47bd9e86d789a62b764e30d944b83d67db89952e77cd4
Score
10/10
Malware Config
Extracted
Family
-
cobaltstrike
C2
-
http://192.144.225.94:4444/Aov7
Attributes
-
user_agent
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows Phone OS 7.5; Trident/5.0; IEMobile/9.0; LG; LG-E906)
Signatures
- Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\28b8413419b5656cecb272e07079b047_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\28b8413419b5656cecb272e07079b047_JaffaCakes118.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2532-0-0x0000000180000000-0x00000001803C0000-memory.dmp
memory/2532-5-0x000001CB5EBD0000-0x000001CB5EBF3000-memory.dmp
memory/2532-10-0x000001CB5E430000-0x000001CB5E431000-memory.dmp