Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

e1b703526b...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    93s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/12/2024, 13:40

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    e1b703526b0fdf027f75f2562a9cb8fc_JaffaCakes118.exe

  • Size

    416KB

  • MD5

    e1b703526b0fdf027f75f2562a9cb8fc

  • SHA1

    10fc1395c5001211ffbddf6b2a188d69596099a8

  • SHA256

    2b863afbb81e80888e969f68c369607b6135a1ef0040c46bdf388dd072fa0e3f

  • SHA512

    0870c4473f429821c24eefbad9b0e4d7b7ebbd69779705889d9de0e890616405f201b2b077f8fe9fe89026094433d0d773df2a4e09e026e92943a315b133e9ce

  • SSDEEP

    12288:ptzF2m10CzpnPZsmeGwgZO4a0whY1/5NFN:ptMmSGsmeOa0f1BNFN

Score
10/10
expirobackdoor

Malware Config

Signatures

  • Expiro family
    expiro
  • Expiro, m0yv

    Expiro aka m0yv is a multi-functional backdoor written in C++.

    backdoorexpiro
  • Expiro payload 4 IoCs
    backdoor

Processes

  • C:\Users\Admin\AppData\Local\Temp\e1b703526b0fdf027f75f2562a9cb8fc_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\e1b703526b0fdf027f75f2562a9cb8fc_JaffaCakes118.exe"
    1⤵
      PID:4676

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/4676-0-0x000000000046C000-0x00000000004FF000-memory.dmp

      Filesize

      588KB

      Download

    • memory/4676-1-0x0000000000400000-0x00000000004FF000-memory.dmp

      Filesize

      1020KB

      Download

    • memory/4676-3-0x0000000000400000-0x00000000004FF000-memory.dmp

      Filesize

      1020KB

      Download

    • memory/4676-2-0x000000000046C000-0x00000000004FF000-memory.dmp

      Filesize

      588KB

      Download