Overview

overview

10

Static

static

3

JaffaCakes...29.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09-01-2025 12:09

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    JaffaCakes118_c7cfcd145d0c32d46f2e7fd084444f29.exe

  • Size

    432KB

  • MD5

    c7cfcd145d0c32d46f2e7fd084444f29

  • SHA1

    78ba77ae87a73593cbe91a61608d8390acceb666

  • SHA256

    f63d4a95cd6b4c5e6be15c6776726cf335ced32d34d1b9064b1f4314fd2b840a

  • SHA512

    f4d86daf53e7ff9a71e0de72e082c1e6ba9ba38b9e511e3a6e9c4fd5922fa7c900440c14ae4d383c19775d75dbe079cddd2354e0412d01ad7f0555f975e211d2

  • SSDEEP

    6144:cFUCmZqoFWC6xlYR/hP44YC0v7YmXAmUDpYR8dfzaXwgCXoc3lIXtAjruWc/ndEU:wUCmZiCKcYX1QmIp/dyml6twr6vvo

Score
10/10
expirobackdoor

Malware Config

Signatures

  • Expiro family
    expiro
  • Expiro, m0yv

    Expiro aka m0yv is a multi-functional backdoor written in C++.

    backdoorexpiro
  • Expiro payload 3 IoCs
    backdoor

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c7cfcd145d0c32d46f2e7fd084444f29.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c7cfcd145d0c32d46f2e7fd084444f29.exe"
    1⤵
      PID:2820

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2820-0-0x0000000000470000-0x0000000000504000-memory.dmp

      Filesize

      592KB

      Download

    • memory/2820-2-0x0000000000400000-0x0000000000504000-memory.dmp

      Filesize

      1.0MB

      Download

    • memory/2820-1-0x0000000000470000-0x0000000000504000-memory.dmp

      Filesize

      592KB

      Download