Analysis
-
max time kernel
94s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
02/01/2025, 10:02
General
-
Target
JaffaCakes118_64493d469fb9951ce19422c97774e199.exe
-
Size
780KB
-
MD5
64493d469fb9951ce19422c97774e199
-
SHA1
984d84d8f66004431283e13b6bd8cd459887e509
-
SHA256
84a94f133ca3c45027f952e5580699cb31dbba91e49f05ae3f36bcb0100de73b
-
SHA512
496b3e91208b4b2ab6c89d0095dc86d05afc1e6af077bfbbbf382232be738d44a8cab40de44a1edc400aacdb042e3f15ce92129678630a33dddbbbfa074d730c
-
SSDEEP
12288:jYw0HtXO3L236JpclJZji21wrU3UtEOk2asHBTttBRS8aQH8v8sVeZ:jeO3L23tW3UU4S7BE86e
Score
10/10
Malware Config
Signatures
-
Expiro family
-
Expiro, m0yv
Expiro aka m0yv is a multi-functional backdoor written in C++.
-
Expiro payload 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_64493d469fb9951ce19422c97774e199.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_64493d469fb9951ce19422c97774e199.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.9MB
-
Filesize
4KB
-
Filesize
1.9MB