Overview

overview

10

Static

static

3

JaffaCakes...0d.exe

windows7-x64

10

JaffaCakes...0d.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_1b1071e58bf6a85eda6b0a27562de00d

  • Size

    472KB

  • Sample

    241231-pkkw4azmhx

  • MD5

    1b1071e58bf6a85eda6b0a27562de00d

  • SHA1

    829c143f7fd6f7d80ca93ce7defee2944a2c0cc7

  • SHA256

    074c485967fa1a356f14c49ecb49fdfe19833b5401bd727daca572cd2d5b9794

  • SHA512

    88e94d8dee668503a6b856c0cf587eba22f602b2c590d42476db8a27088d078a307d7be7468d2ef4bd8043de5897c8cd303512aead2148832d5d9aef23073bc8

  • SSDEEP

    12288:DCPzrOBcpsSeLm7inay076SWqM1QQOiy:qrOBjS4m/y076SW/eQO

Score
10/10
expirobackdoordiscoveryevasiontrojan

Malware Config

Targets

    • Target

      JaffaCakes118_1b1071e58bf6a85eda6b0a27562de00d

    • Size

      472KB

    • MD5

      1b1071e58bf6a85eda6b0a27562de00d

    • SHA1

      829c143f7fd6f7d80ca93ce7defee2944a2c0cc7

    • SHA256

      074c485967fa1a356f14c49ecb49fdfe19833b5401bd727daca572cd2d5b9794

    • SHA512

      88e94d8dee668503a6b856c0cf587eba22f602b2c590d42476db8a27088d078a307d7be7468d2ef4bd8043de5897c8cd303512aead2148832d5d9aef23073bc8

    • SSDEEP

      12288:DCPzrOBcpsSeLm7inay076SWqM1QQOiy:qrOBjS4m/y076SW/eQO

    Score
    10/10
    expirobackdoordiscoveryevasiontrojan

    • Expiro family

      expiro

    • Expiro, m0yv

      Expiro aka m0yv is a multi-functional backdoor written in C++.

      backdoorexpiro

    • Expiro payload

      backdoor

    • Disables taskbar notifications via registry modification

      evasion

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks