Analysis
-
max time kernel
94s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
04-01-2025 13:43
General
-
Target
JaffaCakes118_7a005fd53e4a3f5ff0192ea4b7090699.exe
-
Size
415KB
-
MD5
7a005fd53e4a3f5ff0192ea4b7090699
-
SHA1
1618d0f7d46a6c07b79f13005ea39cc9a115fd62
-
SHA256
e6e731aa7a555d24e130df62cd29c9227b77fc66dccea92ea468bcc5eccf2e4e
-
SHA512
e208f69ba569e34bb78ab5f0c3346a1b54d45d8eafbc6995dc88a2010dcdc96088919d80aa392dfd0d6ae3d89ff12f3a4a992d0569e71f61893c5298c242b7d4
-
SSDEEP
6144:LrByKsic7aHx9Iqt7RudL/W5stmpMDNKNcsCYPQtNq0X8WGtbJCx8d:LrByKsibRiIRCzE8rKdCY4/L58
Score
10/10
Malware Config
Signatures
-
Expiro family
-
Expiro, m0yv
Expiro aka m0yv is a multi-functional backdoor written in C++.
-
Expiro payload 4 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7a005fd53e4a3f5ff0192ea4b7090699.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7a005fd53e4a3f5ff0192ea4b7090699.exe"1⤵
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
588KB
-
Filesize
588KB
-
Filesize
1016KB
-
Filesize
1016KB