General

  • Target

    da605f9078dd3a4742f1610d7ab0ac42_JaffaCakes118

  • Size

    128KB

  • Sample

    240911-pzf7fs1flc

  • MD5

    da605f9078dd3a4742f1610d7ab0ac42

  • SHA1

    e3d919db3c511feeaa627b266d2cb5b53e2217a9

  • SHA256

    2644e0b801c7f32d78edeeec7d31cd69bb855a70ad5ed02de963f96997e7c09b

  • SHA512

    40a7a8bdc518ebd960ec22598d34b62b03197ca447e37a45b17c5196f08fbedb87b5e0d01a0a4852eb8c0787902e9d21580fda13cc6bb64648383b66b2262b1c

  • SSDEEP

    768:3E30e/7tEaWcArSwaydTb0EroSd3QXGsBS4sZFFSUv6GfEK+RsWW2qTN4lvCy2Zv:A+PeXonnUStQXDI4spvVp+N8NECtH3

Malware Config

Targets

    • Target

      da605f9078dd3a4742f1610d7ab0ac42_JaffaCakes118

    • Size

      128KB

    • MD5

      da605f9078dd3a4742f1610d7ab0ac42

    • SHA1

      e3d919db3c511feeaa627b266d2cb5b53e2217a9

    • SHA256

      2644e0b801c7f32d78edeeec7d31cd69bb855a70ad5ed02de963f96997e7c09b

    • SHA512

      40a7a8bdc518ebd960ec22598d34b62b03197ca447e37a45b17c5196f08fbedb87b5e0d01a0a4852eb8c0787902e9d21580fda13cc6bb64648383b66b2262b1c

    • SSDEEP

      768:3E30e/7tEaWcArSwaydTb0EroSd3QXGsBS4sZFFSUv6GfEK+RsWW2qTN4lvCy2Zv:A+PeXonnUStQXDI4spvVp+N8NECtH3

    • Expiro, m0yv

      Expiro aka m0yv is a multi-functional backdoor written in C++.

    • Expiro payload

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Modifies WinLogon

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks