Analysis
-
max time kernel
94s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
07/01/2025, 01:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
JaffaCakes118_448f5e199faafd800655ccc1e096ffa9.exe
Resource
win7-20241023-en
3 signatures
150 seconds
General
-
Target
JaffaCakes118_448f5e199faafd800655ccc1e096ffa9.exe
-
Size
415KB
-
MD5
448f5e199faafd800655ccc1e096ffa9
-
SHA1
87bafac9df74ad3cebb50e1dc1214060ae0e1eca
-
SHA256
bd6364595c47ba974e31f6eda78bf7a7384f92f64e645548b3d42f2eb3c21e9c
-
SHA512
8645109afa17add1a1813c0b303018abe78bea8327768621658a3b7a141557421afe5ea32cf5197573e66435f790a14d8bcc6a776b95ebf434b6d79e57b77931
-
SSDEEP
12288:/rsyKsi6Ye+0GjbZxWhMF77904n8FTyHOXxaAjY:/rsyKsi6J+BbZA07y4ATy/AM
Malware Config
Signatures
-
Expiro family
-
Expiro payload 3 IoCs
resource yara_rule behavioral2/memory/3996-0-0x0000000000B9B000-0x0000000000C2E000-memory.dmp family_expiro1 behavioral2/memory/3996-1-0x0000000000B9B000-0x0000000000C2E000-memory.dmp family_expiro1 behavioral2/memory/3996-2-0x0000000000B30000-0x0000000000C2E000-memory.dmp family_expiro1 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_448f5e199faafd800655ccc1e096ffa9.exe