expiro | 5639bc47a49bb52533377e6745bf5f5809da5545af49047e9fd16784fc926ceb

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240730-en
resource tags

arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system
submitted
01/08/2024, 13:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
809ab5c212a4c5120d2dbd641dacdbb2_JaffaCakes118.exe
Size 88KB
Sample240801-qe95gaweqf
SHA256 5639bc47a49bb52533377e6745bf5f5809da5545af49047e9fd16784fc926ceb
MD5 809ab5c212a4c5120d2dbd641dacdbb2
SHA1 1276d8efb1a93028082ce7319cfaf97f40f88dae
SHA512 8ce1ed511919f30f817b451977e870ca7dd8fd28de38eac10e8c256216bc9e312e709d4e6f6a1d6d8009fc2b22c1320ca0856305ea12dbda6f0e7c4fc939fc0d
SSDEEP 1536:X+PeXonnUStQXDI4spvVp+N8NECtH3/ItaRmtmhDA2B/w:XFgnUStM0BFn+N8FP2acIhDp
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

expiro backdoor discovery persistence

Malware Config

Signatures

Expiro, m0yv
Expiro aka m0yv is a multi-functional backdoor written in C++.
backdoor expiro

Expiro payload 6 IoCs

backdoor

resource	yara_rule
behavioral2/memory/4472-5-0x0000000000400000-0x000000000040B000-memory.dmp	family_expiro2
behavioral2/memory/4472-9-0x0000000000400000-0x000000000040B000-memory.dmp	family_expiro2
behavioral2/memory/4868-19-0x0000000000400000-0x000000000040B000-memory.dmp	family_expiro2
behavioral2/memory/4868-20-0x0000000000400000-0x000000000040B000-memory.dmp	family_expiro2
behavioral2/memory/4868-22-0x0000000000400000-0x000000000040B000-memory.dmp	family_expiro2
behavioral2/memory/4868-25-0x0000000000400000-0x000000000040B000-memory.dmp	family_expiro2

Executes dropped EXE 2 IoCs

pid	Process
3668	service204.exe
4868	service204.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-113082768-653872390-2867000172-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Adobe Reader Speed Launcher = "C:\\Windows\\SysWOW64\\service204.exe"	service204.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Adobe Reader Speed Launcher = "C:\\Windows\\SysWOW64\\service204.exe"	service204.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	service204.exe
File opened (read-only)	\??\F:	service204.exe

Modifies WinLogon 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Adobe Reader Speed Launcher = "C:\\Windows\\SysWOW64\\service204.exe"	service204.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\service204.exe	809ab5c212a4c5120d2dbd641dacdbb2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\service204.exe	809ab5c212a4c5120d2dbd641dacdbb2_JaffaCakes118.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3160 set thread context of 4472	3160	809ab5c212a4c5120d2dbd641dacdbb2_JaffaCakes118.exe	86
PID 3668 set thread context of 4868	3668	service204.exe	88

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	809ab5c212a4c5120d2dbd641dacdbb2_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	809ab5c212a4c5120d2dbd641dacdbb2_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	service204.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	service204.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 3160 wrote to memory of 4472	3160	809ab5c212a4c5120d2dbd641dacdbb2_JaffaCakes118.exe	86
PID 3160 wrote to memory of 4472	3160	809ab5c212a4c5120d2dbd641dacdbb2_JaffaCakes118.exe	86
PID 3160 wrote to memory of 4472	3160	809ab5c212a4c5120d2dbd641dacdbb2_JaffaCakes118.exe	86
PID 3160 wrote to memory of 4472	3160	809ab5c212a4c5120d2dbd641dacdbb2_JaffaCakes118.exe	86
PID 3160 wrote to memory of 4472	3160	809ab5c212a4c5120d2dbd641dacdbb2_JaffaCakes118.exe	86
PID 3160 wrote to memory of 4472	3160	809ab5c212a4c5120d2dbd641dacdbb2_JaffaCakes118.exe	86
PID 3160 wrote to memory of 4472	3160	809ab5c212a4c5120d2dbd641dacdbb2_JaffaCakes118.exe	86
PID 4472 wrote to memory of 3668	4472	809ab5c212a4c5120d2dbd641dacdbb2_JaffaCakes118.exe	87
PID 4472 wrote to memory of 3668	4472	809ab5c212a4c5120d2dbd641dacdbb2_JaffaCakes118.exe	87
PID 4472 wrote to memory of 3668	4472	809ab5c212a4c5120d2dbd641dacdbb2_JaffaCakes118.exe	87
PID 3668 wrote to memory of 4868	3668	service204.exe	88
PID 3668 wrote to memory of 4868	3668	service204.exe	88
PID 3668 wrote to memory of 4868	3668	service204.exe	88
PID 3668 wrote to memory of 4868	3668	service204.exe	88
PID 3668 wrote to memory of 4868	3668	service204.exe	88
PID 3668 wrote to memory of 4868	3668	service204.exe	88
PID 3668 wrote to memory of 4868	3668	service204.exe	88

C:\Users\Admin\AppData\Local\Temp\809ab5c212a4c5120d2dbd641dacdbb2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\809ab5c212a4c5120d2dbd641dacdbb2_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3160
- C:\Users\Admin\AppData\Local\Temp\809ab5c212a4c5120d2dbd641dacdbb2_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\809ab5c212a4c5120d2dbd641dacdbb2_JaffaCakes118.exe"
  2⤵
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4472
- - C:\Windows\SysWOW64\service204.exe
    -n
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3668
  - - C:\Windows\SysWOW64\service204.exe
      -n
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Enumerates connected drives
      Modifies WinLogon
      System Location Discovery: System Language Discovery
      PID:4868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

service204.exe

Path C:\Windows\SysWOW64\service204.exe
Size 88KB
SHA256 5639bc47a49bb52533377e6745bf5f5809da5545af49047e9fd16784fc926ceb
MD5 809ab5c212a4c5120d2dbd641dacdbb2
SHA1 1276d8efb1a93028082ce7319cfaf97f40f88dae
SHA512 8ce1ed511919f30f817b451977e870ca7dd8fd28de38eac10e8c256216bc9e312e709d4e6f6a1d6d8009fc2b22c1320ca0856305ea12dbda6f0e7c4fc939fc0d
SSDEEP 1536:X+PeXonnUStQXDI4spvVp+N8NECtH3/ItaRmtmhDA2B/w:XFgnUStM0BFn+N8FP2acIhDp
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3160-0-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/3160-3-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/3668-16-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/4472-1-0x0000000000400000-0x000000000040B000-memory.dmp

Download

memory/4472-4-0x0000000000400000-0x000000000040B000-memory.dmp

Download

memory/4472-5-0x0000000000400000-0x000000000040B000-memory.dmp

Download

memory/4472-9-0x0000000000400000-0x000000000040B000-memory.dmp

Download

memory/4868-19-0x0000000000400000-0x000000000040B000-memory.dmp

Download

memory/4868-20-0x0000000000400000-0x000000000040B000-memory.dmp

Download

memory/4868-22-0x0000000000400000-0x000000000040B000-memory.dmp

Download

memory/4868-25-0x0000000000400000-0x000000000040B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads