Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
27-06-2024 04:43
Behavioral task
behavioral1
Sample
14b8871a783f6d8d8f335b503e6dc7b2_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
14b8871a783f6d8d8f335b503e6dc7b2_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
14b8871a783f6d8d8f335b503e6dc7b2_JaffaCakes118.exe
-
Size
10.3MB
-
MD5
14b8871a783f6d8d8f335b503e6dc7b2
-
SHA1
c0e1757cf3510a16edd91c229a3da148a297fc37
-
SHA256
3dcf1ef8cd50a04198bc7d8392f1512ae50f0fc8f195b98d25831d695826306b
-
SHA512
9e60b6cc4453608cb9f75f056a8abe71539a61d0d9bf632cf03753737318b8c4c07918eefe2ace4da11e86ba96790f490fcc1c1def8f504ac0c2564ccffa01bc
-
SSDEEP
196608:Td+GIxLVhQ9onJ5hrZERoyiU8AdZYJERS48RmU/3ZlsPvD2aRLrTOg8CORKRqbZ:UPVVm9c5hlER0AdZYygtN3ZWqahriR
Malware Config
Extracted
cobaltstrike
http://207.148.112.209:443/ODee
-
user_agent
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)
Signatures
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Loads dropped DLL 7 IoCs
Processes:
14b8871a783f6d8d8f335b503e6dc7b2_JaffaCakes118.exepid process 1252 14b8871a783f6d8d8f335b503e6dc7b2_JaffaCakes118.exe 1252 14b8871a783f6d8d8f335b503e6dc7b2_JaffaCakes118.exe 1252 14b8871a783f6d8d8f335b503e6dc7b2_JaffaCakes118.exe 1252 14b8871a783f6d8d8f335b503e6dc7b2_JaffaCakes118.exe 1252 14b8871a783f6d8d8f335b503e6dc7b2_JaffaCakes118.exe 1252 14b8871a783f6d8d8f335b503e6dc7b2_JaffaCakes118.exe 1252 14b8871a783f6d8d8f335b503e6dc7b2_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
14b8871a783f6d8d8f335b503e6dc7b2_JaffaCakes118.exedescription pid process target process PID 2560 wrote to memory of 1252 2560 14b8871a783f6d8d8f335b503e6dc7b2_JaffaCakes118.exe 14b8871a783f6d8d8f335b503e6dc7b2_JaffaCakes118.exe PID 2560 wrote to memory of 1252 2560 14b8871a783f6d8d8f335b503e6dc7b2_JaffaCakes118.exe 14b8871a783f6d8d8f335b503e6dc7b2_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\14b8871a783f6d8d8f335b503e6dc7b2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\14b8871a783f6d8d8f335b503e6dc7b2_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\14b8871a783f6d8d8f335b503e6dc7b2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\14b8871a783f6d8d8f335b503e6dc7b2_JaffaCakes118.exe"2⤵
- Loads dropped DLL
PID:1252
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
99KB
MD58697c106593e93c11adc34faa483c4a0
SHA1cd080c51a97aa288ce6394d6c029c06ccb783790
SHA256ff43e813785ee948a937b642b03050bb4b1c6a5e23049646b891a66f65d4c833
SHA512724bbed7ce6f7506e5d0b43399fb3861dda6457a2ad2fafe734f8921c9a4393b480cdd8a435dbdbd188b90236cb98583d5d005e24fa80b5a0622a6322e6f3987
-
Filesize
122KB
MD529da9b022c16da461392795951ce32d9
SHA10e514a8f88395b50e797d481cbbed2b4ae490c19
SHA2563b4012343ef7a266db0b077bbb239833779192840d1e2c43dfcbc48ffd4c5372
SHA5125c7d83823f1922734625cf69a481928a5c47b6a3bceb7f24c9197175665b2e06bd1cfd745c55d1c5fe1572f2d8da2a1dcc1c1f5de0903477bb927aca22ecb26a
-
Filesize
77KB
MD5f5dd9c5922a362321978c197d3713046
SHA14fbc2d3e15f8bb21ecc1bf492f451475204426cd
SHA2564494992665305fc9401ed327398ee40064fe26342fe44df11d89d2ac1cc6f626
SHA512ce818113bb87c6e38fa85156548c6f207aaab01db311a6d8c63c6d900d607d7beff73e64d717f08388ece4b88bf8b95b71911109082cf4b0c0a9b0663b9a8e99
-
Filesize
761KB
MD581a81220192e1cc8231f0fb84893e8ac
SHA1381513ca91bb8ea4c237c2220b0b858f1c8bbb86
SHA256075ec82c1d46cdc2d81d346c9576c73a78547d42076467d5d11a8517850d9b1e
SHA5127ca97f218f07137bd050d1f562c9c71d9f11ba6b110e1a13092c53b541896c3d349a967525dcfc6d607d6c3c3ed43cb7518620137c4442f2f8ba6d40f0a8fa13
-
Filesize
32KB
MD5eef7981412be8ea459064d3090f4b3aa
SHA1c60da4830ce27afc234b3c3014c583f7f0a5a925
SHA256f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
SHA512dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016
-
Filesize
1KB
MD52aeec77fe026972dfb7f8ff8a14dc9c2
SHA1aa619632e32027b0430c7d8d9e294971ac8e4595
SHA2563d555efb9aedd7a6444d0366e772db410c3ecd9a2da785c22fb97475b0758fbf
SHA512f0929def24035123ac1949bd93715c7e80652c301c3514d4e9d731cee6deca0a753c376496f6ae2433bcdfcb537c855c504f0bd44442832b012f52edbc8ac076
-
Filesize
4.3MB
MD511c051f93c922d6b6b4829772f27a5be
SHA142fbdf3403a4bc3d46d348ca37a9f835e073d440
SHA2560eabf135bb9492e561bbbc5602a933623c9e461aceaf6eb1ceced635e363cd5c
SHA5121cdec23486cffcb91098a8b2c3f1262d6703946acf52aa2fe701964fb228d1411d9b6683bd54527860e10affc0e3d3de92a6ecf2c6c8465e9c8b9a7304e2a4a6
-
Filesize
26KB
MD57a442bbcc4b7aa02c762321f39487ba9
SHA10fcb5bbdd0c3d3c5943e557cc2a5b43e20655b83
SHA2561dd7bba480e65802657c31e6d20b1346d11bca2192575b45eb9760a4feb468ad
SHA5123433c46c7603ae0a73aa9a863b2aecd810f8c0cc6c2cd96c71ef6bde64c275e0fceb4ea138e46a5c9bf72f66dcdea3e9551cf2103188a1e98a92d8140879b34c
-
Filesize
1000KB
MD5126821f73fd9ffce6e091cf9480e1b60
SHA1d10bbe9b65c2c6f8fca6850d0b79cbc6ef04d691
SHA2567b28f46f0a09cfd9129109a94b1c16c9c62eef46c09113c4c585d9bf0e69b2da
SHA512e61ad6c90551022fc257be95f6296a9f7d5a7aeaabd5349d81b1b31ea69b75dc3397698331f363d9fc2b005d9289a06dc1dcc2078e74b52775e0aae64daea36e