General

  • Target

    dde5e61693d027de112a9dbd5f41621e_JaffaCakes118

  • Size

    68KB

  • Sample

    240913-hnwdnszgpb

  • MD5

    dde5e61693d027de112a9dbd5f41621e

  • SHA1

    c0a6b555e41abb09e36f72c6ca99fe4633edd618

  • SHA256

    17c17e12abf2cdb498c13de25965acf237690835a488c96fcaa584ac0c2f4419

  • SHA512

    31909bad685fecf8b58f2089951cdb210e09170ca88a0d0dfdaf3ef5c6aa6d78307bbade3fa88435fc2876a8f11ef52951cc3b9488e0537fed51d2d4fc8be41d

  • SSDEEP

    768:1XzlX7m2PX2uC3P1UtKzlJsEqDlEVBRDKwsB9nMZnANQ1N/4U7rYxamg46MVpo:1D02PX2uCUtT9DlkBRDPsBcs0WpgX6O

Malware Config

Targets

    • Target

      dde5e61693d027de112a9dbd5f41621e_JaffaCakes118

    • Size

      68KB

    • MD5

      dde5e61693d027de112a9dbd5f41621e

    • SHA1

      c0a6b555e41abb09e36f72c6ca99fe4633edd618

    • SHA256

      17c17e12abf2cdb498c13de25965acf237690835a488c96fcaa584ac0c2f4419

    • SHA512

      31909bad685fecf8b58f2089951cdb210e09170ca88a0d0dfdaf3ef5c6aa6d78307bbade3fa88435fc2876a8f11ef52951cc3b9488e0537fed51d2d4fc8be41d

    • SSDEEP

      768:1XzlX7m2PX2uC3P1UtKzlJsEqDlEVBRDKwsB9nMZnANQ1N/4U7rYxamg46MVpo:1D02PX2uCUtT9DlkBRDPsBcs0WpgX6O

    • Expiro, m0yv

      Expiro aka m0yv is a multi-functional backdoor written in C++.

    • Expiro payload

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Modifies WinLogon

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks