expiro | 1e1a5f5ef9be5b76508a3209c28638d4101da25af4e0c5c432a01710b06e014e

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
02/01/2025, 05:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
Size

567KB
MD5

6311bbc6a7405395ad2fa2bec933c526
SHA1

0e578d7d2aee45d6989064e991a42a5a8e02ec5f
SHA256

1e1a5f5ef9be5b76508a3209c28638d4101da25af4e0c5c432a01710b06e014e
SHA512

f47cb218247d5d8e727107db2a3e92e40a5ec0a66f5a3b09cdfe071f08a3b69aaa2feaa52bbc61d59ecc3330367e776181122941893ea547193bbb498bbd2104
SSDEEP

12288:sKRRaMMMMM2MMMMM/J7Z3PNBoX917k9b1jhho+uN4vmrRr9az6:sKRRaMMMMM2MMMMM/J9lBoX91YrjhhdE

Score

10^/10

expiro backdoor credential_access discovery spyware stealer

Malware Config

Signatures

Expiro family
expiro
Expiro, m0yv
Expiro aka m0yv is a multi-functional backdoor written in C++.
backdoor expiro

Expiro payload 1 IoCs

backdoor

resource	yara_rule
behavioral2/memory/1632-2-0x0000000001000000-0x00000000011AA000-memory.dmp	family_expiro1

Executes dropped EXE 8 IoCs

pid	Process
3644	elevation_service.exe
1380	elevation_service.exe
3508	maintenanceservice.exe
2532	OSE.EXE
2136	ssh-agent.exe
5096	AgentService.exe
60	wbengine.exe
1948	TrustedInstaller.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Drops Chrome extension 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\dlddmedljhmbgdhapibnagaanenmajcm\1.0_0\manifest.json	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\P:	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File opened (read-only)	\??\Q:	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File opened (read-only)	\??\V:	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File opened (read-only)	\??\W:	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File opened (read-only)	\??\Y:	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File opened (read-only)	\??\H:	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File opened (read-only)	\??\J:	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File opened (read-only)	\??\O:	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File opened (read-only)	\??\N:	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File opened (read-only)	\??\S:	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File opened (read-only)	\??\Z:	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File opened (read-only)	\??\L:	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File opened (read-only)	\??\R:	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File opened (read-only)	\??\U:	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File opened (read-only)	\??\X:	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File opened (read-only)	\??\E:	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File opened (read-only)	\??\I:	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File opened (read-only)	\??\K:	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File opened (read-only)	\??\G:	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File opened (read-only)	\??\M:	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File opened (read-only)	\??\T:	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe

Drops file in System32 directory 61 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system32\svchost.exe	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File opened for modification	\??\c:\windows\SysWOW64\lsass.exe	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File opened for modification	\??\c:\windows\SysWOW64\msdtc.exe	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File opened for modification	\??\c:\windows\system32\vds.exe	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File created	\??\c:\windows\system32\wbengine.vir	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File opened for modification	\??\c:\windows\SysWOW64\openssh\ssh-agent.exe	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File opened for modification	\??\c:\windows\SysWOW64\alg.exe	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File opened for modification	\??\c:\windows\system32\alg.exe	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File opened for modification	\??\c:\windows\SysWOW64\Appvclient.exe	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File opened for modification	\??\c:\windows\SysWOW64\diagsvcs\diagnosticshub.standardcollector.service.exe	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File opened for modification	\??\c:\windows\SysWOW64\locator.exe	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File opened for modification	\??\c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File opened for modification	\??\c:\windows\SysWOW64\sensordataservice.exe	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File opened for modification	\??\c:\windows\SysWOW64\sgrmbroker.exe	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File opened for modification	\??\c:\windows\SysWOW64\wbengine.exe	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File created	\??\c:\windows\system32\WindowsPowerShell\v1.0\powershell.vir	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File created	\??\c:\windows\system32\fxssvc.vir	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File created	\??\c:\windows\system32\msdtc.vir	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File opened for modification	\??\c:\windows\system32\sgrmbroker.exe	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File opened for modification	\??\c:\windows\SysWOW64\snmptrap.exe	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File opened for modification	\??\c:\windows\SysWOW64\vssvc.exe	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File opened for modification	\??\c:\windows\system32\perceptionsimulation\perceptionsimulationservice.exe	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File created	\??\c:\windows\system32\openssh\ssh-agent.vir	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File opened for modification	\??\c:\windows\system32\Agentservice.exe	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File opened for modification	\??\c:\windows\system32\vssvc.exe	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File opened for modification	\??\c:\windows\system32\searchindexer.exe	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File opened for modification	\??\c:\windows\SysWOW64\svchost.exe	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File opened for modification	\??\c:\windows\system32\tieringengineservice.exe	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File opened for modification	\??\c:\windows\system32\wbengine.exe	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File opened for modification	\??\c:\windows\system32\lsass.exe	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File opened for modification	\??\c:\windows\SysWOW64\searchindexer.exe	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File opened for modification	\??\c:\windows\system32\locator.exe	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File opened for modification	\??\c:\windows\SysWOW64\spectrum.exe	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File opened for modification	\??\c:\windows\SysWOW64\dllhost.exe	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File opened for modification	\??\c:\windows\system32\msdtc.exe	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File opened for modification	\??\c:\windows\system32\sensordataservice.exe	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File created	\??\c:\windows\system32\Agentservice.vir	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File opened for modification	\??\c:\windows\SysWOW64\vds.exe	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.vir	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File opened for modification	\??\c:\windows\system32\Appvclient.exe	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File opened for modification	\??\c:\windows\system32\snmptrap.exe	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File opened for modification	\??\c:\windows\system32\openssh\ssh-agent.exe	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File opened for modification	\??\c:\windows\SysWOW64\tieringengineservice.exe	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File opened for modification	\??\c:\windows\system32\wbem\wmiApsrv.exe	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File created	\??\c:\windows\system32\snmptrap.vir	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File opened for modification	\??\c:\windows\SysWOW64\wbem\wmiApsrv.exe	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File opened for modification	\??\c:\windows\SysWOW64\perceptionsimulation\perceptionsimulationservice.exe	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File opened for modification	\??\c:\windows\system32\WindowsPowerShell\v1.0\powershell.exe	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File opened for modification	\??\c:\windows\system32\fxssvc.exe	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File created	\??\c:\windows\SysWOW64\msiexec.vir	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File opened for modification	\??\c:\windows\system32\spectrum.exe	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File opened for modification	\??\c:\windows\SysWOW64\fxssvc.exe	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File opened for modification	\??\c:\windows\SysWOW64\perfhost.exe	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File created	\??\c:\windows\system32\msiexec.vir	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File opened for modification	\??\c:\windows\SysWOW64\Agentservice.exe	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File created	\??\c:\windows\system32\Appvclient.vir	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File opened for modification	\??\c:\windows\system32\dllhost.exe	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File opened for modification	\??\c:\windows\system32\diagsvcs\diagnosticshub.standardcollector.service.exe	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File opened for modification	\??\c:\windows\SysWOW64\msiexec.exe	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File opened for modification	\??\c:\windows\system32\msiexec.exe	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jdeps.vir	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.123\notification_helper.exe	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javac.vir	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.vir	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File created	\??\c:\program files (x86)\mozilla maintenance service\maintenanceservice.vir	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.vir	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.vir	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javap.vir	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javaws.vir	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File created	C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.vir	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File created	C:\Program Files\Internet Explorer\ieinstal.vir	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File created	C:\Program Files\Java\jre-1.8\bin\jjs.vir	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File created	C:\Program Files\Java\jdk-1.8\bin\extcheck.vir	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jps.vir	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.vir	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jar.vir	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jdb.vir	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\mip.vir	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File created	C:\Program Files\Internet Explorer\ExtExport.vir	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File created	C:\Program Files\Java\jre-1.8\bin\unpack200.vir	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jconsole.vir	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File created	C:\Program Files\Java\jre-1.8\bin\orbd.vir	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.vir	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File created	C:\Program Files\Java\jdk-1.8\bin\xjc.vir	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File created	C:\Program Files\Microsoft Office\root\Integration\Integrator.vir	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javaw.vir	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File created	C:\Program Files\Java\jdk-1.8\bin\appletviewer.vir	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javadoc.vir	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jhat.vir	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File opened for modification	\??\c:\program files (x86)\microsoft\edge\Application\92.0.902.67\elevation_service.exe	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File created	C:\Program Files\Java\jdk-1.8\bin\schemagen.vir	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File created	C:\Program Files\Java\jre-1.8\bin\javaw.vir	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File opened for modification	\??\c:\program files (x86)\mozilla maintenance service\maintenanceservice.exe	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmid.vir	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.vir	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File created	C:\Program Files\Java\jre-1.8\bin\javacpl.vir	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\servicing\trustedinstaller.exe	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
File created	C:\Windows\Logs\CBS\CBS.log	TrustedInstaller.exe
File opened for modification	C:\Windows\Logs\CBS\CBS.log	TrustedInstaller.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v3.0\wpf\presentationfontcache.exe	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
668	Process not Found
668	Process not Found

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1632	JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6311bbc6a7405395ad2fa2bec933c526.exe"
1⤵
- Drops Chrome extension
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1632

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3644

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1380

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3508

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2532

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2136

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
PID:5096

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
PID:60

C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\servicing\TrustedInstaller.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

Filesize
2.1MB

MD5
082afe556ac814fc4c6752f3f452cc0c

SHA1
52395a223f1e9e34ba33d0fff87dc602d0c367af

SHA256
f0b6a61836d31ae1140f1e4a8d39c5cf1eccc61f5a08b1c6bc3204ea491c49dc

SHA512
71eec140e149800d446d47ac3cc9b3aee3a516edd48bd5ae5a2937a670ae1b91738d853cbc4c3d68a278985d7b4dabb4c91ca3cb1823d3dc45d26f053ae07752

Download Submit
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

Filesize
731KB

MD5
ec4305b4f6d1757eb22e549073a45de4

SHA1
5771f282c97c8fa1efbdd456fff249d09e91656c

SHA256
025eeaebd81e3e24eb35a8c0338ce967a56495656fad51bc11602c01278972a3

SHA512
638f952a6ef93fc1c310edb20cbc506d78165f5ea847ac9b1cd7cba1347cf94c7f94d9be6a3982c203969ab23a9a317d52c6dc9dbf47a13716f8953be3b2222b

Download Submit
C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

Filesize
748KB

MD5
ac9428b6aa2269e098c04f4d24ec43b5

SHA1
3213322d86808402cf5f1688595bb2b3e3c87233

SHA256
bb2745d3fcd99d9e5541497f1f9a7f5255de1421271b44397f0b4fc6bb66de94

SHA512
1c4fa764b79d2991d25a03393aef4d983a858402612136949b1db71e7d220fbc9ffbb1e6e1899a9959917ca77eff473fa3f37e10090b538b7bf5cb8db4c24c48

Download Submit
C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.vir

Filesize
4.5MB

MD5
a75b786a44a32053693b39459d1493eb

SHA1
e2114ad2fb08d27276b7b533c024993c828eebb1

SHA256
ae28fba666227a60ef9d8725da70c62a2aee397476a934e1620d8724ece49140

SHA512
3208ace96d94178bf32b729673a969e97171e76c7ad13c39f25508d45d3733311746d188abc204d2ee245824ea8a098f7bf15948403c36dd8e047cb1d8aab72b

Download Submit
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe

Filesize
2.1MB

MD5
f6c77d81208d72208ee8745220e7a451

SHA1
795d68550b94aab79cd8f4f75c28c6539673fd43

SHA256
eb7d940989ced6c11ef89ddfdc08ab0085be4bbaae8fdf48943aaebfdf73c7e3

SHA512
f68078c0252634d679e771a8b0a50f8346fbe28a8a4d503a4e1a9ceea22e697a8feac8e212aec207ac11ad8abcc810aa3d6bac63d2d1a4ad8647cfbe8b1ae184

Download Submit
C:\Program Files\Internet Explorer\iexplore.exe

Filesize
1.3MB

MD5
0c011d6c69282851f5a426d8f2eb0b41

SHA1
ce8ae5958716bc48f77158450c11d253a00baa17

SHA256
3eac385c96375443218cb70a18e20b41146258f5cfbbb7234e128959034b5356

SHA512
95efc672edab9a31493ec0c6c75a6781ae77e72328e43aa9c37240c09dbd7686b87bd51afbd4614fc5afadaa8bb3889732a84aa474871c9a92862d40d9918644

Download Submit
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Filesize
931KB

MD5
b5c93a87918482db53486aa53984fe2c

SHA1
127ad99a94cc159c82cefa30e5d049a89cee08ff

SHA256
79e69d95f26dc980823edd66f97d52115ea248345f8a90aea4b8345de28a4e66

SHA512
a7193186e6eee5c0fe650707527afcc788b5940bafddd04d3f16c9e7839fc4f68ffd987e8f0bcebec732c96e794ae0607ab40c17995fafdb78ceab9aeb5a29b3

Download Submit
C:\Windows\System32\AgentService.exe

Filesize
1.7MB

MD5
2c3c1a04f8fca2f327e447acbe907e10

SHA1
06a239a2b17668c3e149dca2ee5f27f508c9d265

SHA256
7502deac1f64ade0900e4cdbe6327b9eaa1071b21efd810810c8c488f0db8f6e

SHA512
cca02716a8bde2906696cbe45faef8797ba39641df08989b1d92496fd9d7b1c189bff17e50f6aafc2f303961c078dbde19c15608ccfecdcaa8ec4504c8b21026

Download Submit
C:\Windows\System32\Appvclient.vir

Filesize
1.2MB

MD5
cb8c2a49a427853837ed82e4945f05c5

SHA1
5b5a143392ee846910586daab59fabf389c97aff

SHA256
a03ea1db54f5e9350b24bb5a8ac4f6c56df8bb24cb3d983852ff468611f546ee

SHA512
883498165d14813887900da8cf12b1e04ea9ded1b1da1d7c1ecd6b9d7c64c81a0ab01dad33b14c9d032c57314b47fa1214a49ab41b7d66bf65b398cd68841bd6

Download Submit
C:\Windows\System32\OpenSSH\ssh-agent.exe

Filesize
882KB

MD5
92c2ab4ef685fa1c360e1ef690cdcf09

SHA1
b2dbf1abe416ef9e41440217bda41f587cee8fcf

SHA256
e448ed8318836b3721f86d40cf5a50981613e73b8081ac88383eb7a308e795ff

SHA512
84bb248d0b7a719922f1e3157b4612f34a77fe302b1210967677aa7a628f9640e7fe4b144ce0bd0ad29b6b407d8fe2dd7dcd9354c0cf5837fcc30130689144c5

Download Submit
C:\Windows\System32\wbengine.exe

Filesize
2.0MB

MD5
4288ea1c92a75cc17f53458f39d32d81

SHA1
1be7c9ccda259c53b5cdd8785d3425761ddd96b5

SHA256
c39152d54adbae6151b90149af9dbc95592732aa6c60105e792357c7cd8f17bc

SHA512
1768552e5b453e92ee920d50329ed55e0b8b627bfb03497823ab01ec3d4af2dc1984b43f1e6539f342d525400e6d1cdee3d5bde9fd940c940aef6e70607a461d

Download Submit
C:\Windows\servicing\TrustedInstaller.exe

Filesize
193KB

MD5
805418acd5280e97074bdadca4d95195

SHA1
a69e4f03d775a7a0cc5ed2d5569cbfbb4d31d2d6

SHA256
73684e31ad4afe3fdc525b51ccaacc14d402c92db9c42e3fcbfe1e65524b1c01

SHA512
630a255950c0ae0983ae907d20326adea36ce262c7784428a0811b04726849c929bc9cea338a89e77447a6cec30b0889694158327c002566d3cf5be2bb88e4de

Download Submit
memory/60-90-0x0000000140000000-0x000000014034A000-memory.dmp

Filesize
3.3MB

Download
memory/60-89-0x0000000140000000-0x000000014034A000-memory.dmp

Filesize
3.3MB

Download
memory/1380-29-0x0000000140000000-0x000000014035F000-memory.dmp

Filesize
3.4MB

Download
memory/1380-28-0x0000000140000000-0x000000014035F000-memory.dmp

Filesize
3.4MB

Download
memory/1632-1-0x0000000001002000-0x0000000001003000-memory.dmp

Filesize
4KB

Download
memory/1632-0-0x0000000001000000-0x00000000011AA000-memory.dmp

Filesize
1.7MB

Download
memory/1632-2-0x0000000001000000-0x00000000011AA000-memory.dmp

Filesize
1.7MB

Download
memory/2136-73-0x0000000140000000-0x0000000140236000-memory.dmp

Filesize
2.2MB

Download
memory/2136-74-0x0000000140000000-0x0000000140236000-memory.dmp

Filesize
2.2MB

Download
memory/2532-59-0x0000000140000000-0x0000000140203000-memory.dmp

Filesize
2.0MB

Download
memory/2532-60-0x0000000140000000-0x0000000140203000-memory.dmp

Filesize
2.0MB

Download
memory/3508-37-0x0000000140000000-0x0000000140203000-memory.dmp

Filesize
2.0MB

Download
memory/3508-36-0x0000000140000000-0x0000000140203000-memory.dmp

Filesize
2.0MB

Download
memory/3644-21-0x0000000140000000-0x0000000140368000-memory.dmp

Filesize
3.4MB

Download
memory/3644-20-0x0000000140000000-0x0000000140368000-memory.dmp

Filesize
3.4MB

Download
memory/5096-82-0x0000000140000000-0x00000001402F4000-memory.dmp

Filesize
3.0MB

Download
memory/5096-81-0x0000000140000000-0x00000001402F4000-memory.dmp

Filesize
3.0MB

Download