Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
11-05-2024 00:51
Static task
static1
Behavioral task
behavioral1
Sample
31e76eae575a96c479dd7538e345e678_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
31e76eae575a96c479dd7538e345e678_JaffaCakes118.exe
Resource
win10v2004-20240426-en
General
-
Target
31e76eae575a96c479dd7538e345e678_JaffaCakes118.exe
-
Size
2.6MB
-
MD5
31e76eae575a96c479dd7538e345e678
-
SHA1
152bad46aa90b15f8ff40f6327dc02c6005e9a8d
-
SHA256
85b23e5e52505b2ef3aa587c35f311d4ec2c7d28de85e4cdc0f003f3a819d199
-
SHA512
ad491d275ce156ea262fc7c3feb50d71079b2f4c6c6bf7656e4027277f8af12b4b0ff9c7e84826f8da6ae13c630e408cc2d1ea046ed386381ba524b209b6208d
-
SSDEEP
49152:K3x6z65bWvJGihDPn1ctlwkYppCyegmnVM:K3665baGQDP1cokYTCykn
Malware Config
Extracted
sendsafe
UNREGISTERED
31.44.184.73:50013
31.44.184.73:50014
-
service_name
Enterprise Mailing Service
Signatures
-
SendSafe payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/3296-1-0x0000000000400000-0x00000000005C9000-memory.dmp sendsafe behavioral2/memory/3296-3-0x0000000000400000-0x00000000005C9000-memory.dmp sendsafe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
31e76eae575a96c479dd7538e345e678_JaffaCakes118.exepid process 3296 31e76eae575a96c479dd7538e345e678_JaffaCakes118.exe 3296 31e76eae575a96c479dd7538e345e678_JaffaCakes118.exe