Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
31-03-2024 03:18
Behavioral task
behavioral1
Sample
4bbc7c53d45152aa23d2d3f4322ed490_JaffaCakes118.ps1
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
4bbc7c53d45152aa23d2d3f4322ed490_JaffaCakes118.ps1
Resource
win10v2004-20240226-en
General
-
Target
4bbc7c53d45152aa23d2d3f4322ed490_JaffaCakes118.ps1
-
Size
194KB
-
MD5
4bbc7c53d45152aa23d2d3f4322ed490
-
SHA1
5508b012ff7ef2b34375f3a4b3067dbbfb4a453d
-
SHA256
fbd7a548c9687bd0a74f905b03cedb8072717c67b04ddd05418f2f9cbb7076ac
-
SHA512
ffb032a143e14215e6417d8f317958c0e18e4fbf99a940f4a07221590831a9e9d8f3202e4938593f9e2be30ad479cabec6e2fc90e76bc0d93a9d26d8d7a9631a
-
SSDEEP
3072:xKngySVRgypwBolhfJv0DO/sUy2T9QOcH9cHUD1lv9LGbIVu5kqKtjOt0BZ:xtNnXNXfJv0DWyP9SUhgGhA07
Malware Config
Extracted
cobaltstrike
0
http://auditsecuritybusworld.com:443/jquery-3.3.1.min.js
http://213.227.155.246:443/jquery-3.3.1.min.js
-
access_type
512
-
beacon_type
2048
-
host
auditsecuritybusworld.com,/jquery-3.3.1.min.js,213.227.155.246,/jquery-3.3.1.min.js
-
http_header1
AAAACgAAAEdBY2NlcHQ6IHRleHQvaHRtbCxhcHBsaWNhdGlvbi94aHRtbCt4bWwsYXBwbGljYXRpb24veG1sO3E9MC45LCovKjtxPTAuOAAAAAoAAAAgUmVmZXJlcjogaHR0cDovL2NvZGUuanF1ZXJ5LmNvbS8AAAAKAAAAHkFjY2VwdC1FbmNvZGluZzogZ3ppcCwgZGVmbGF0ZQAAAAcAAAAAAAAADQAAAAIAAAAJX19jZmR1aWQ9AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_header2
AAAACgAAAEdBY2NlcHQ6IHRleHQvaHRtbCxhcHBsaWNhdGlvbi94aHRtbCt4bWwsYXBwbGljYXRpb24veG1sO3E9MC45LCovKjtxPTAuOAAAAAoAAAAgUmVmZXJlcjogaHR0cDovL2NvZGUuanF1ZXJ5LmNvbS8AAAAKAAAAHkFjY2VwdC1FbmNvZGluZzogZ3ppcCwgZGVmbGF0ZQAAAAcAAAAAAAAADwAAAA0AAAAFAAAACF9fY2ZkdWlkAAAABwAAAAEAAAAPAAAADQAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_method1
GET
-
http_method2
POST
-
jitter
9472
-
polling_time
45000
-
port_number
443
-
sc_process32
%windir%\syswow64\dllhost.exe
-
sc_process64
%windir%\sysnative\dllhost.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCnOM3nXx+7HBhkbDd+AwFrFisSunK999w2tM0uTpuuEiBalcJhcL+QgQWtf6S7zPp5hjImG+2YcPl18geU4f5JlSPXHwilbK4DFb/ePWyKFjhrA7emVRqhM21QMlo1ANsn14rY/RO2pzuft8P7TXoIjjI/B2GGVuzYNZX6X4I2EwIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4.234810624e+09
-
unknown2
AAAABAAAAAEAAAXyAAAAAgAAAFQAAAACAAAPWwAAAA0AAAAPAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/jquery-3.3.2.min.js
-
user_agent
Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Blocklisted process makes network request 2 IoCs
Processes:
powershell.exeflow pid process 33 2184 powershell.exe 42 2184 powershell.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
powershell.exepowershell.exepid process 4564 powershell.exe 4564 powershell.exe 2184 powershell.exe 2184 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
powershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 4564 powershell.exe Token: SeDebugPrivilege 2184 powershell.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
powershell.exedescription pid process target process PID 4564 wrote to memory of 2184 4564 powershell.exe powershell.exe PID 4564 wrote to memory of 2184 4564 powershell.exe powershell.exe PID 4564 wrote to memory of 2184 4564 powershell.exe powershell.exe
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\4bbc7c53d45152aa23d2d3f4322ed490_JaffaCakes118.ps11⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\syswow64\windowspowershell\v1.0\powershell.exe"c:\windows\syswow64\windowspowershell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCacheFilesize
53KB
MD593678e82d776686aa54c42b8a98e6cbc
SHA1802939dfed99ac74814c4371388b204c5810241d
SHA256da32a79a8e04cbafb1c5980b3d6225f4705010df5eb45d464cd5bf6b642d7841
SHA5120b412a1e11c0639d72f6a58c661ecc43da021c010c4d1e66051c5a376ebab287480bbf663345c9bd2a79ec3a35a9788cf04d74d612449f76fe2c87576cd13520
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fzibzx3k.42a.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
memory/2184-25-0x0000000005D40000-0x0000000005DA6000-memory.dmpFilesize
408KB
-
memory/2184-15-0x0000000074700000-0x0000000074EB0000-memory.dmpFilesize
7.7MB
-
memory/2184-31-0x0000000006130000-0x0000000006484000-memory.dmpFilesize
3.3MB
-
memory/2184-45-0x0000000006CB0000-0x0000000006CE4000-memory.dmpFilesize
208KB
-
memory/2184-32-0x0000000006620000-0x000000000663E000-memory.dmpFilesize
120KB
-
memory/2184-16-0x0000000003010000-0x0000000003020000-memory.dmpFilesize
64KB
-
memory/2184-14-0x0000000002F30000-0x0000000002F66000-memory.dmpFilesize
216KB
-
memory/2184-33-0x00000000066F0000-0x000000000673C000-memory.dmpFilesize
304KB
-
memory/2184-18-0x0000000005710000-0x0000000005D38000-memory.dmpFilesize
6.2MB
-
memory/2184-19-0x0000000005640000-0x0000000005662000-memory.dmpFilesize
136KB
-
memory/2184-44-0x0000000003010000-0x0000000003020000-memory.dmpFilesize
64KB
-
memory/2184-26-0x0000000005EA0000-0x0000000005F06000-memory.dmpFilesize
408KB
-
memory/2184-43-0x0000000074700000-0x0000000074EB0000-memory.dmpFilesize
7.7MB
-
memory/2184-38-0x0000000006F80000-0x00000000073F2000-memory.dmpFilesize
4.4MB
-
memory/2184-17-0x0000000003010000-0x0000000003020000-memory.dmpFilesize
64KB
-
memory/2184-34-0x0000000007600000-0x0000000007C7A000-memory.dmpFilesize
6.5MB
-
memory/2184-35-0x0000000006B60000-0x0000000006B7A000-memory.dmpFilesize
104KB
-
memory/2184-37-0x0000000006CB0000-0x0000000006CE4000-memory.dmpFilesize
208KB
-
memory/2184-36-0x0000000006F80000-0x00000000073F2000-memory.dmpFilesize
4.4MB
-
memory/4564-11-0x000001517BDA0000-0x000001517BDB0000-memory.dmpFilesize
64KB
-
memory/4564-39-0x00007FFE05F50000-0x00007FFE06A11000-memory.dmpFilesize
10.8MB
-
memory/4564-10-0x00007FFE05F50000-0x00007FFE06A11000-memory.dmpFilesize
10.8MB
-
memory/4564-12-0x000001517D110000-0x000001517D286000-memory.dmpFilesize
1.5MB
-
memory/4564-0-0x000001517BDF0000-0x000001517BE12000-memory.dmpFilesize
136KB
-
memory/4564-13-0x000001517D4A0000-0x000001517D6AA000-memory.dmpFilesize
2.0MB