General

  • Target

    c3c86955a7d62a9fa52ae357793ecaa6_JaffaCakes118

  • Size

    60KB

  • Sample

    240826-y961aswalq

  • MD5

    c3c86955a7d62a9fa52ae357793ecaa6

  • SHA1

    3d05fa2ffd1aacadaafc52b7b6b5031915e3c6a1

  • SHA256

    fbde91ec1bc48a895c0b5ac3c3588da96bb45cdbc56ebabcce43d2a2b4eca8ea

  • SHA512

    4c5075d163d184c4edc417017b0433a4f897e44ea18341d809d9dc3bdbad88c046f109743467354f1c19c660e75fad91423493888e8c453b7c725cddae47d269

  • SSDEEP

    768:EE30e/7tEaWcArSwaydTb0EroSd3QXGsBS4sZFFSUv6GfEK+RsWW2qTN4lvCy2ZL:V+PeXonnUStQXDI4spvVp+N8NECtH3T

Malware Config

Targets

    • Target

      c3c86955a7d62a9fa52ae357793ecaa6_JaffaCakes118

    • Size

      60KB

    • MD5

      c3c86955a7d62a9fa52ae357793ecaa6

    • SHA1

      3d05fa2ffd1aacadaafc52b7b6b5031915e3c6a1

    • SHA256

      fbde91ec1bc48a895c0b5ac3c3588da96bb45cdbc56ebabcce43d2a2b4eca8ea

    • SHA512

      4c5075d163d184c4edc417017b0433a4f897e44ea18341d809d9dc3bdbad88c046f109743467354f1c19c660e75fad91423493888e8c453b7c725cddae47d269

    • SSDEEP

      768:EE30e/7tEaWcArSwaydTb0EroSd3QXGsBS4sZFFSUv6GfEK+RsWW2qTN4lvCy2ZL:V+PeXonnUStQXDI4spvVp+N8NECtH3T

    • Expiro, m0yv

      Expiro aka m0yv is a multi-functional backdoor written in C++.

    • Expiro payload

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Modifies WinLogon

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks