Analysis
-
max time kernel
120s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
03-01-2025 01:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
JaffaCakes118_698a97d49a0fce555e50c67cf7efe1b0.exe
Resource
win7-20241010-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
JaffaCakes118_698a97d49a0fce555e50c67cf7efe1b0.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
1 signatures
150 seconds
General
-
Target
JaffaCakes118_698a97d49a0fce555e50c67cf7efe1b0.exe
-
Size
1.1MB
-
MD5
698a97d49a0fce555e50c67cf7efe1b0
-
SHA1
c3246065692f424f9010f8a0a29fa6413c235686
-
SHA256
e1c3b2ed80892f506bc138aa92544f54b99f0cee4e7fa4c03c58fb74ba747ffd
-
SHA512
313252100e191b5c319eec40d864cf28c8fd970f231b6a22c3417cf4daf94c119faf05b4c8da9e0cb95205d63074cf2c41eaa40018b0dbc7ad631a5d1787b020
-
SSDEEP
24576:/VyEIohMRSfw0RTQZjHKPjiqSMz9xLZ/JO5unIEz5bbhwgl1lifISM8f:/VpMiwWTQZjHKPji/MxxcuIebhh1lmu
Malware Config
Signatures
-
Expiro family
-
Expiro payload 4 IoCs
resource yara_rule behavioral1/memory/2948-0-0x0000000000513000-0x000000000053A000-memory.dmp family_expiro1 behavioral1/memory/2948-1-0x0000000000400000-0x000000000053A000-memory.dmp family_expiro1 behavioral1/memory/2948-144-0x0000000000513000-0x000000000053A000-memory.dmp family_expiro1 behavioral1/memory/2948-145-0x0000000000400000-0x000000000053A000-memory.dmp family_expiro1 -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\GUM57FF.tmp\goopdateres_es-419.dll JaffaCakes118_698a97d49a0fce555e50c67cf7efe1b0.exe File created C:\Program Files (x86)\GUM57FF.tmp\goopdateres_iw.dll JaffaCakes118_698a97d49a0fce555e50c67cf7efe1b0.exe File created C:\Program Files (x86)\GUM57FF.tmp\goopdateres_lt.dll JaffaCakes118_698a97d49a0fce555e50c67cf7efe1b0.exe File created C:\Program Files (x86)\GUM57FF.tmp\psmachine.dll JaffaCakes118_698a97d49a0fce555e50c67cf7efe1b0.exe File created C:\Program Files (x86)\GUM57FF.tmp\goopdateres_ca.dll JaffaCakes118_698a97d49a0fce555e50c67cf7efe1b0.exe File created C:\Program Files (x86)\GUM57FF.tmp\goopdateres_cs.dll JaffaCakes118_698a97d49a0fce555e50c67cf7efe1b0.exe File created C:\Program Files (x86)\GUM57FF.tmp\npGoogleUpdate3.dll JaffaCakes118_698a97d49a0fce555e50c67cf7efe1b0.exe File created C:\Program Files (x86)\GUM57FF.tmp\goopdateres_vi.dll JaffaCakes118_698a97d49a0fce555e50c67cf7efe1b0.exe File created C:\Program Files (x86)\GUM57FF.tmp\GoogleUpdateSetup.exe JaffaCakes118_698a97d49a0fce555e50c67cf7efe1b0.exe File created C:\Program Files (x86)\GUM57FF.tmp\goopdateres_es.dll JaffaCakes118_698a97d49a0fce555e50c67cf7efe1b0.exe File created C:\Program Files (x86)\GUM57FF.tmp\goopdateres_th.dll JaffaCakes118_698a97d49a0fce555e50c67cf7efe1b0.exe File created C:\Program Files (x86)\GUM57FF.tmp\psuser.dll JaffaCakes118_698a97d49a0fce555e50c67cf7efe1b0.exe File created C:\Program Files (x86)\GUM57FF.tmp\goopdateres_ar.dll JaffaCakes118_698a97d49a0fce555e50c67cf7efe1b0.exe File created C:\Program Files (x86)\GUM57FF.tmp\goopdateres_en-GB.dll JaffaCakes118_698a97d49a0fce555e50c67cf7efe1b0.exe File created C:\Program Files (x86)\GUM57FF.tmp\goopdateres_da.dll JaffaCakes118_698a97d49a0fce555e50c67cf7efe1b0.exe File created C:\Program Files (x86)\GUM57FF.tmp\goopdateres_sr.dll JaffaCakes118_698a97d49a0fce555e50c67cf7efe1b0.exe File created C:\Program Files (x86)\GUM57FF.tmp\goopdateres_is.dll JaffaCakes118_698a97d49a0fce555e50c67cf7efe1b0.exe File created C:\Program Files (x86)\GUM57FF.tmp\goopdateres_kn.dll JaffaCakes118_698a97d49a0fce555e50c67cf7efe1b0.exe File created C:\Program Files (x86)\GUM57FF.tmp\goopdateres_ro.dll JaffaCakes118_698a97d49a0fce555e50c67cf7efe1b0.exe File created C:\Program Files (x86)\GUM57FF.tmp\goopdateres_hi.dll JaffaCakes118_698a97d49a0fce555e50c67cf7efe1b0.exe File created C:\Program Files (x86)\GUM57FF.tmp\goopdateres_ms.dll JaffaCakes118_698a97d49a0fce555e50c67cf7efe1b0.exe File created C:\Program Files (x86)\GUM57FF.tmp\goopdateres_pt-PT.dll JaffaCakes118_698a97d49a0fce555e50c67cf7efe1b0.exe File created C:\Program Files (x86)\GUM57FF.tmp\goopdateres_uk.dll JaffaCakes118_698a97d49a0fce555e50c67cf7efe1b0.exe File created C:\Program Files (x86)\GUM57FF.tmp\goopdateres_ur.dll JaffaCakes118_698a97d49a0fce555e50c67cf7efe1b0.exe File created C:\Program Files (x86)\GUM57FF.tmp\GoogleCrashHandler.exe JaffaCakes118_698a97d49a0fce555e50c67cf7efe1b0.exe File created C:\Program Files (x86)\GUM57FF.tmp\goopdate.dll JaffaCakes118_698a97d49a0fce555e50c67cf7efe1b0.exe File created C:\Program Files (x86)\GUM57FF.tmp\goopdateres_et.dll JaffaCakes118_698a97d49a0fce555e50c67cf7efe1b0.exe File created C:\Program Files (x86)\GUM57FF.tmp\goopdateres_zh-TW.dll JaffaCakes118_698a97d49a0fce555e50c67cf7efe1b0.exe File created C:\Program Files (x86)\GUM57FF.tmp\goopdateres_am.dll JaffaCakes118_698a97d49a0fce555e50c67cf7efe1b0.exe File created C:\Program Files (x86)\GUM57FF.tmp\goopdateres_no.dll JaffaCakes118_698a97d49a0fce555e50c67cf7efe1b0.exe File created C:\Program Files (x86)\GUM57FF.tmp\goopdateres_ru.dll JaffaCakes118_698a97d49a0fce555e50c67cf7efe1b0.exe File created C:\Program Files (x86)\GUM57FF.tmp\goopdateres_ko.dll JaffaCakes118_698a97d49a0fce555e50c67cf7efe1b0.exe File created C:\Program Files (x86)\GUM57FF.tmp\goopdateres_sv.dll JaffaCakes118_698a97d49a0fce555e50c67cf7efe1b0.exe File created C:\Program Files (x86)\GUM57FF.tmp\GoogleUpdate.exe JaffaCakes118_698a97d49a0fce555e50c67cf7efe1b0.exe File created C:\Program Files (x86)\GUM57FF.tmp\GoogleUpdateBroker.exe JaffaCakes118_698a97d49a0fce555e50c67cf7efe1b0.exe File created C:\Program Files (x86)\GUM57FF.tmp\goopdateres_fi.dll JaffaCakes118_698a97d49a0fce555e50c67cf7efe1b0.exe File created C:\Program Files (x86)\GUM57FF.tmp\goopdateres_el.dll JaffaCakes118_698a97d49a0fce555e50c67cf7efe1b0.exe File created C:\Program Files (x86)\GUM57FF.tmp\goopdateres_mr.dll JaffaCakes118_698a97d49a0fce555e50c67cf7efe1b0.exe File opened for modification C:\Program Files (x86)\GUM57FF.tmp\GoogleUpdateSetup.exe JaffaCakes118_698a97d49a0fce555e50c67cf7efe1b0.exe File created C:\Program Files (x86)\GUM57FF.tmp\psmachine_64.dll JaffaCakes118_698a97d49a0fce555e50c67cf7efe1b0.exe File created C:\Program Files (x86)\GUM57FF.tmp\goopdateres_en.dll JaffaCakes118_698a97d49a0fce555e50c67cf7efe1b0.exe File created C:\Program Files (x86)\GUM57FF.tmp\goopdateres_fa.dll JaffaCakes118_698a97d49a0fce555e50c67cf7efe1b0.exe File created C:\Program Files (x86)\GUM57FF.tmp\goopdateres_id.dll JaffaCakes118_698a97d49a0fce555e50c67cf7efe1b0.exe File created C:\Program Files (x86)\GUM57FF.tmp\goopdateres_pl.dll JaffaCakes118_698a97d49a0fce555e50c67cf7efe1b0.exe File created C:\Program Files (x86)\GUM57FF.tmp\goopdateres_ta.dll JaffaCakes118_698a97d49a0fce555e50c67cf7efe1b0.exe File created C:\Program Files (x86)\GUM57FF.tmp\goopdateres_tr.dll JaffaCakes118_698a97d49a0fce555e50c67cf7efe1b0.exe File created C:\Program Files (x86)\GUM57FF.tmp\GoogleUpdateHelper.msi JaffaCakes118_698a97d49a0fce555e50c67cf7efe1b0.exe File created C:\Program Files (x86)\GUM57FF.tmp\goopdateres_de.dll JaffaCakes118_698a97d49a0fce555e50c67cf7efe1b0.exe File created C:\Program Files (x86)\GUM57FF.tmp\goopdateres_hu.dll JaffaCakes118_698a97d49a0fce555e50c67cf7efe1b0.exe File created C:\Program Files (x86)\GUM57FF.tmp\goopdateres_fil.dll JaffaCakes118_698a97d49a0fce555e50c67cf7efe1b0.exe File created C:\Program Files (x86)\GUM57FF.tmp\goopdateres_fr.dll JaffaCakes118_698a97d49a0fce555e50c67cf7efe1b0.exe File created C:\Program Files (x86)\GUM57FF.tmp\goopdateres_ja.dll JaffaCakes118_698a97d49a0fce555e50c67cf7efe1b0.exe File created C:\Program Files (x86)\GUM57FF.tmp\goopdateres_ml.dll JaffaCakes118_698a97d49a0fce555e50c67cf7efe1b0.exe File created C:\Program Files (x86)\GUM57FF.tmp\goopdateres_zh-CN.dll JaffaCakes118_698a97d49a0fce555e50c67cf7efe1b0.exe File opened for modification C:\Program Files (x86)\GUT5800.tmp JaffaCakes118_698a97d49a0fce555e50c67cf7efe1b0.exe File created C:\Program Files (x86)\GUM57FF.tmp\GoogleUpdateWebPlugin.exe JaffaCakes118_698a97d49a0fce555e50c67cf7efe1b0.exe File created C:\Program Files (x86)\GUM57FF.tmp\GoogleCrashHandler64.exe JaffaCakes118_698a97d49a0fce555e50c67cf7efe1b0.exe File created C:\Program Files (x86)\GUM57FF.tmp\goopdateres_te.dll JaffaCakes118_698a97d49a0fce555e50c67cf7efe1b0.exe File created C:\Program Files (x86)\GUM57FF.tmp\goopdateres_bg.dll JaffaCakes118_698a97d49a0fce555e50c67cf7efe1b0.exe File created C:\Program Files (x86)\GUM57FF.tmp\goopdateres_lv.dll JaffaCakes118_698a97d49a0fce555e50c67cf7efe1b0.exe File created C:\Program Files (x86)\GUM57FF.tmp\goopdateres_pt-BR.dll JaffaCakes118_698a97d49a0fce555e50c67cf7efe1b0.exe File created C:\Program Files (x86)\GUM57FF.tmp\goopdateres_it.dll JaffaCakes118_698a97d49a0fce555e50c67cf7efe1b0.exe File created C:\Program Files (x86)\GUM57FF.tmp\goopdateres_sl.dll JaffaCakes118_698a97d49a0fce555e50c67cf7efe1b0.exe File created C:\Program Files (x86)\GUM57FF.tmp\GoogleUpdateComRegisterShell64.exe JaffaCakes118_698a97d49a0fce555e50c67cf7efe1b0.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_698a97d49a0fce555e50c67cf7efe1b0.exe