Analysis

  • max time kernel
    150s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    31-08-2024 07:24

General

  • Target

    cc6962b007a8512fd286d0d50489e3f0_JaffaCakes118.exe

  • Size

    900KB

  • MD5

    cc6962b007a8512fd286d0d50489e3f0

  • SHA1

    326665ca3524b4b1afbf2ecb5c3096ff19e7de55

  • SHA256

    deba095b9ba5ffd6ea866849da264d0197efbaf12acd27b900213354d0fa18ff

  • SHA512

    4173a8311a6feeac481ecc8551252122f0fd04e1a9a7fb549d735078e5bf84a6e8e311f905c0e30f3eaef1eaf1bbd50eb05de3b623922f0a9859c9b99be1fa4d

  • SSDEEP

    24576:ZotQUwXBNssktnYM441giJ22zPubfCMqtPQgqevcZGq2bl:OtQUgQPuOJtTtvcZVwl

Malware Config

Signatures

  • Expiro, m0yv

    Expiro aka m0yv is a multi-functional backdoor written in C++.

  • Expiro payload 23 IoCs
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in System32 directory 6 IoCs
  • Drops file in Windows directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • NTFS ADS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 30 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 42 IoCs

Processes

  • C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    1⤵
      PID:1172
    • C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      1⤵
        PID:1344
      • C:\Windows\Explorer.EXE
        C:\Windows\Explorer.EXE
        1⤵
          PID:1424
          • C:\Users\Admin\AppData\Local\Temp\cc6962b007a8512fd286d0d50489e3f0_JaffaCakes118.exe
            "C:\Users\Admin\AppData\Local\Temp\cc6962b007a8512fd286d0d50489e3f0_JaffaCakes118.exe"
            2⤵
            • Loads dropped DLL
            • Drops file in System32 directory
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:2112
            • C:\Users\Admin\AppData\Roaming\Hisi\legyx.exe
              "C:\Users\Admin\AppData\Roaming\Hisi\legyx.exe"
              3⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:2680
              • C:\Windows\SysWOW64\explorer.exe
                "C:\Windows\SysWOW64\explorer.exe"
                4⤵
                • Adds Run key to start application
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:2000
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp13a692f2.bat"
              3⤵
              • Deletes itself
              • System Location Discovery: System Language Discovery
              PID:1952
        • C:\Windows\system32\DllHost.exe
          C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
          1⤵
            PID:1664
          • C:\Program Files\Windows Mail\WinMail.exe
            "C:\Program Files\Windows Mail\WinMail.exe" -Embedding
            1⤵
            • NTFS ADS
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of SetWindowsHookEx
            PID:2612

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\edb.log

            Filesize

            2.0MB

            MD5

            6fe76f7302781916a954f5bc3c9d2d01

            SHA1

            0aac4a16200cb346bd78ccdd76b58d65c91ec6d9

            SHA256

            26cd74722a4c41fa99a5a6f76c0133f2a388ddbd31f4cbccf41ceb65f672febb

            SHA512

            3cb11580c9e39cd3390febe4f3ae8972217f7efc0b8253ebb61d7da87ea52e6d20e2e2148886822b491bf0287d0122b5aa9a641b35fd75c4c48e24a07cf9e0f0

          • C:\Users\Admin\AppData\Local\Temp\tmp13a692f2.bat

            Filesize

            271B

            MD5

            02ae4550ce4d99e40779bdde19ff0cdd

            SHA1

            31f1f33645cb1fdc4985e6bba1a0349d79d8c583

            SHA256

            fe0947cf8f9c537f05ed1a115accbd9338d5b7316fe73195f59ed6a6be187c9d

            SHA512

            063977bd649ffdc39bb1649ff4e97c9663ac2c132b0c58e935e619fd584ab1d36edb17db4efde67265f4bd3ba4610251185d64b9cc4a7292ec290936d42f542f

          • \Users\Admin\AppData\Roaming\Hisi\legyx.exe

            Filesize

            900KB

            MD5

            27aaea6961b53204805127063a36ec4c

            SHA1

            43c5b46074ae3fb5b7fc26e2686feb2a7e795706

            SHA256

            dbc0ff2275545db2443f10f17bc5eacaeaf6772d48b1d5a8934f558c39c3d2b7

            SHA512

            f5ba921b62ee9003e241eea1ef073054d3c7d75323e68a00130fbd358ba71e6e508000618d36cf442f8163997ee31c66e0385c84af0b0138340cabd76e08347a

          • memory/2000-73-0x0000000000080000-0x00000000000B1000-memory.dmp

            Filesize

            196KB

          • memory/2000-42-0x0000000000210000-0x0000000000211000-memory.dmp

            Filesize

            4KB

          • memory/2000-58-0x0000000000210000-0x0000000000211000-memory.dmp

            Filesize

            4KB

          • memory/2000-56-0x0000000000210000-0x0000000000211000-memory.dmp

            Filesize

            4KB

          • memory/2000-76-0x0000000000080000-0x00000000000B1000-memory.dmp

            Filesize

            196KB

          • memory/2000-70-0x0000000000080000-0x00000000000B1000-memory.dmp

            Filesize

            196KB

          • memory/2000-71-0x0000000000080000-0x00000000000B1000-memory.dmp

            Filesize

            196KB

          • memory/2000-72-0x0000000000080000-0x00000000000B1000-memory.dmp

            Filesize

            196KB

          • memory/2000-74-0x0000000000080000-0x00000000000B1000-memory.dmp

            Filesize

            196KB

          • memory/2000-75-0x0000000000080000-0x00000000000B1000-memory.dmp

            Filesize

            196KB

          • memory/2000-38-0x0000000000210000-0x0000000000211000-memory.dmp

            Filesize

            4KB

          • memory/2000-40-0x0000000000210000-0x0000000000211000-memory.dmp

            Filesize

            4KB

          • memory/2000-54-0x0000000000210000-0x0000000000211000-memory.dmp

            Filesize

            4KB

          • memory/2000-44-0x0000000000210000-0x0000000000211000-memory.dmp

            Filesize

            4KB

          • memory/2000-46-0x0000000000210000-0x0000000000211000-memory.dmp

            Filesize

            4KB

          • memory/2000-34-0x0000000000080000-0x00000000000B1000-memory.dmp

            Filesize

            196KB

          • memory/2000-32-0x0000000000080000-0x00000000000B1000-memory.dmp

            Filesize

            196KB

          • memory/2000-30-0x0000000000080000-0x00000000000B1000-memory.dmp

            Filesize

            196KB

          • memory/2000-26-0x0000000000080000-0x00000000000B1000-memory.dmp

            Filesize

            196KB

          • memory/2000-24-0x0000000000080000-0x00000000000B1000-memory.dmp

            Filesize

            196KB

          • memory/2000-48-0x0000000000210000-0x0000000000211000-memory.dmp

            Filesize

            4KB

          • memory/2000-68-0x0000000000210000-0x0000000000211000-memory.dmp

            Filesize

            4KB

          • memory/2000-66-0x0000000000210000-0x0000000000211000-memory.dmp

            Filesize

            4KB

          • memory/2000-64-0x0000000000210000-0x0000000000211000-memory.dmp

            Filesize

            4KB

          • memory/2000-62-0x0000000000210000-0x0000000000211000-memory.dmp

            Filesize

            4KB

          • memory/2000-60-0x0000000000210000-0x0000000000211000-memory.dmp

            Filesize

            4KB

          • memory/2000-50-0x0000000000210000-0x0000000000211000-memory.dmp

            Filesize

            4KB

          • memory/2000-52-0x0000000000210000-0x0000000000211000-memory.dmp

            Filesize

            4KB

          • memory/2112-257-0x0000000000400000-0x00000000006A3000-memory.dmp

            Filesize

            2.6MB

          • memory/2112-2-0x0000000000400000-0x00000000006A3000-memory.dmp

            Filesize

            2.6MB

          • memory/2112-4-0x0000000000400000-0x00000000006A3000-memory.dmp

            Filesize

            2.6MB

          • memory/2112-1-0x0000000000403000-0x0000000000404000-memory.dmp

            Filesize

            4KB

          • memory/2112-5-0x0000000000400000-0x00000000006A3000-memory.dmp

            Filesize

            2.6MB

          • memory/2112-6-0x0000000000400000-0x00000000006A3000-memory.dmp

            Filesize

            2.6MB

          • memory/2112-98-0x0000000000400000-0x00000000006A3000-memory.dmp

            Filesize

            2.6MB

          • memory/2112-97-0x0000000000403000-0x0000000000404000-memory.dmp

            Filesize

            4KB

          • memory/2112-118-0x00000000033D0000-0x0000000003673000-memory.dmp

            Filesize

            2.6MB

          • memory/2112-92-0x0000000000400000-0x00000000006A3000-memory.dmp

            Filesize

            2.6MB

          • memory/2112-7-0x0000000000400000-0x00000000006A3000-memory.dmp

            Filesize

            2.6MB

          • memory/2112-0-0x0000000000400000-0x00000000006A3000-memory.dmp

            Filesize

            2.6MB

          • memory/2112-16-0x00000000033D0000-0x0000000003673000-memory.dmp

            Filesize

            2.6MB

          • memory/2112-3-0x0000000000400000-0x00000000006A3000-memory.dmp

            Filesize

            2.6MB

          • memory/2112-8-0x0000000000400000-0x00000000006A3000-memory.dmp

            Filesize

            2.6MB

          • memory/2612-77-0x0000000002410000-0x0000000002420000-memory.dmp

            Filesize

            64KB

          • memory/2612-83-0x0000000002470000-0x0000000002480000-memory.dmp

            Filesize

            64KB

          • memory/2680-20-0x0000000000400000-0x00000000006A3000-memory.dmp

            Filesize

            2.6MB

          • memory/2680-17-0x0000000000400000-0x00000000006A3000-memory.dmp

            Filesize

            2.6MB

          • memory/2680-19-0x0000000000400000-0x00000000006A3000-memory.dmp

            Filesize

            2.6MB

          • memory/2680-22-0x0000000000400000-0x00000000006A3000-memory.dmp

            Filesize

            2.6MB

          • memory/2680-18-0x0000000000400000-0x00000000006A3000-memory.dmp

            Filesize

            2.6MB

          • memory/2680-100-0x0000000000400000-0x00000000006A3000-memory.dmp

            Filesize

            2.6MB

          • memory/2680-36-0x0000000000400000-0x00000000006A3000-memory.dmp

            Filesize

            2.6MB

          • memory/2680-135-0x0000000000400000-0x00000000006A3000-memory.dmp

            Filesize

            2.6MB

          • memory/2680-35-0x0000000000400000-0x00000000006A3000-memory.dmp

            Filesize

            2.6MB

          • memory/2680-256-0x0000000000400000-0x00000000006A3000-memory.dmp

            Filesize

            2.6MB

          • memory/2680-37-0x0000000000400000-0x00000000006A3000-memory.dmp

            Filesize

            2.6MB