Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

f04c36d165...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/12/2024, 19:20

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    f04c36d165e1f4fecd30f60a1fd2f729_JaffaCakes118.exe

  • Size

    416KB

  • MD5

    f04c36d165e1f4fecd30f60a1fd2f729

  • SHA1

    e32ad976f42b5e316681f87a371fd0caa54d82b2

  • SHA256

    fe71acb6af085f3793b7da018b6363a868bb4c910779d4d2d5b34e6950930d22

  • SHA512

    406a0ebfbb968237cc6c4b4693c0730bc528f172cf5181a8c41e320c0a0aaf7bd64574b7730223f3c338295e4f66173f6961300d537e4f8b0463a547015c96b4

  • SSDEEP

    12288:9gUv/GZHbVidiG5QUCbT5l4pNNbnEAxfuM:9t/NTxu

Score
10/10
expirobackdoor

Malware Config

Signatures

  • Expiro family
    expiro
  • Expiro, m0yv

    Expiro aka m0yv is a multi-functional backdoor written in C++.

    backdoorexpiro
  • Expiro payload 4 IoCs
    backdoor

Processes

  • C:\Users\Admin\AppData\Local\Temp\f04c36d165e1f4fecd30f60a1fd2f729_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\f04c36d165e1f4fecd30f60a1fd2f729_JaffaCakes118.exe"
    1⤵
      PID:4296

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/4296-0-0x000000000046C000-0x00000000004FF000-memory.dmp

      Filesize

      588KB

      Download

    • memory/4296-1-0x0000000000400000-0x00000000004FF000-memory.dmp

      Filesize

      1020KB

      Download

    • memory/4296-3-0x0000000000400000-0x00000000004FF000-memory.dmp

      Filesize

      1020KB

      Download

    • memory/4296-2-0x000000000046C000-0x00000000004FF000-memory.dmp

      Filesize

      588KB

      Download