Threat Spotlight: WarmCookie/BadSpace
Tags
cmtmf-attack-pattern: Traffic Distribution
maec-delivery-vectors: Watering Hole
attack-pattern: Data Direct Domains - T1583.001 Domains - T1584.001 Javascript - T1059.007 Malvertising - T1583.008 Malware - T1587.001 Malware - T1588.001 Multi-Factor Authentication - T1556.006 Powershell - T1059.001 Rundll32 - T1218.011 Scheduled Task - T1053.005 Social Media - T1593.001 Tool - T1588.002 Powershell - T1086 Rundll32 - T1085 Scheduled Task - T1053
Show in Graph
Common Information
Type Value
UUID 456971bf-9f69-4097-8b1c-b9585ebe7c0b
Fingerprint 8d24d1bd0d6d82c1
Analysis status DONE
Considered CTI value 0
Text language
Published Oct. 23, 2024, 6:02 a.m.
Added to db Oct. 23, 2024, 12:21 p.m.
Last updated Nov. 17, 2024, 6:54 p.m.
Headline Cisco Talos Blog
Title Threat Spotlight: WarmCookie/BadSpace
Detected Hints/Tags/Attributes 78/3/8
Source URLs
Redirection Url
Details Source https://blog.talosintelligence.com/warmcookie-analysis/
URL Provider
Details Provider Source level domain
Details talosintelligence.com blog.talosintelligence.com
RSS Feed
Details Id Enabled Feed title Url Added to db
Details 68 ✔ Cisco Talos Blog https://blog.talosintelligence.com/rss/ 2024-08-30 22:08
Attributes
Details Type #Events CTI Value
Details Domain 904 
snort.org
Details Domain 127 
pua.win
Details File 1018 
rundll32.exe
Details File 127 
c:\windows\system32\rundll32.exe
Details File 1 
tmpfilename.dll
Details File 6 
win.inf
Details File 2 
txt.inf
Details File 2 
malware.css