Analysis
-
max time kernel
142s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
01-05-2024 20:38
Static task
static1
Behavioral task
behavioral1
Sample
0cca0a9832b372a44179ab77ab15d7ea_JaffaCakes118.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
0cca0a9832b372a44179ab77ab15d7ea_JaffaCakes118.exe
Resource
win10v2004-20240419-en
General
-
Target
0cca0a9832b372a44179ab77ab15d7ea_JaffaCakes118.exe
-
Size
2.1MB
-
MD5
0cca0a9832b372a44179ab77ab15d7ea
-
SHA1
750d71664ff8db04c77cbb9e5928ead7ad61635e
-
SHA256
3b47a1a8d51b8b5963dc49026e72b236852007a135b6a21b764caed18ff88d40
-
SHA512
d12b1580178b22b23badbf9654287799e656e6e418563b1df91be5c5067a9b4dd453495e66d867cbfffe9c1bcbda8a3edec6c054ac084b71a8f51143f0413ff3
-
SSDEEP
49152:Pz1VUFWzCJegYMfKfiVZ88kXetY0k+SvNOt:5OLJXfmirqMMvNOt
Malware Config
Extracted
sendsafe
UNREGISTERED
31.44.184.82:50013
31.44.184.82:50014
-
service_name
Enterprise Mailing Service
Signatures
-
SendSafe payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/3024-1-0x0000000000400000-0x00000000005C9000-memory.dmp sendsafe behavioral1/memory/3024-2-0x0000000000400000-0x00000000005C9000-memory.dmp sendsafe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
0cca0a9832b372a44179ab77ab15d7ea_JaffaCakes118.exepid process 3024 0cca0a9832b372a44179ab77ab15d7ea_JaffaCakes118.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
0cca0a9832b372a44179ab77ab15d7ea_JaffaCakes118.exepid process 3024 0cca0a9832b372a44179ab77ab15d7ea_JaffaCakes118.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3024-0-0x00000000020B0000-0x0000000002262000-memory.dmpFilesize
1.7MB
-
memory/3024-1-0x0000000000400000-0x00000000005C9000-memory.dmpFilesize
1.8MB
-
memory/3024-2-0x0000000000400000-0x00000000005C9000-memory.dmpFilesize
1.8MB
-
memory/3024-5-0x00000000020B0000-0x0000000002262000-memory.dmpFilesize
1.7MB