expiro | 41bd9b5145a70dc920a7da9acd00522787a3a35ab5152756040f463d4c4e6695

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
03-01-2025 00:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_6944912b96155c2c7c19cc7d1b1f4c00.exe
Size

883KB
MD5

6944912b96155c2c7c19cc7d1b1f4c00
SHA1

ed75d65f2a0a37c7252d35a6fe6c241c63540da3
SHA256

41bd9b5145a70dc920a7da9acd00522787a3a35ab5152756040f463d4c4e6695
SHA512

b70615e81dd1219760233deddec6795f72ea393d3fa61435388046494b3be667861ad117aa2d86fbeaa460874528ef89fb77d24aa27edb8fdba1f9d683325e93
SSDEEP

24576:VDkjbaqfrV8t+CTuxc637p29VcJzN+xICJz9OEk4:VCXf4rT297pJJ8NJAl

Score

10^/10

expiro backdoor discovery

Malware Config

Signatures

Expiro family
expiro
Expiro, m0yv
Expiro aka m0yv is a multi-functional backdoor written in C++.
backdoor expiro

Expiro payload 2 IoCs

backdoor

resource	yara_rule
behavioral2/memory/1516-5-0x0000000000400000-0x0000000000614000-memory.dmp	family_expiro1
behavioral2/memory/1516-17-0x0000000000400000-0x0000000000614000-memory.dmp	family_expiro1

Drops file in System32 directory 16 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\SysWOW64\alg.exe	JaffaCakes118_6944912b96155c2c7c19cc7d1b1f4c00.exe
File opened for modification	\??\c:\windows\SysWOW64\diagsvcs\diagnosticshub.standardcollector.service.exe	JaffaCakes118_6944912b96155c2c7c19cc7d1b1f4c00.exe
File opened for modification	\??\c:\windows\system32\fxssvc.exe	JaffaCakes118_6944912b96155c2c7c19cc7d1b1f4c00.exe
File opened for modification	\??\c:\windows\SysWOW64\svchost.exe	JaffaCakes118_6944912b96155c2c7c19cc7d1b1f4c00.exe
File opened for modification	\??\c:\windows\system32\svchost.exe	JaffaCakes118_6944912b96155c2c7c19cc7d1b1f4c00.exe
File opened for modification	\??\c:\windows\system32\Appvclient.exe	JaffaCakes118_6944912b96155c2c7c19cc7d1b1f4c00.exe
File created	\??\c:\windows\system32\ooknqafk.tmp	JaffaCakes118_6944912b96155c2c7c19cc7d1b1f4c00.exe
File opened for modification	\??\c:\windows\SysWOW64\dllhost.exe	JaffaCakes118_6944912b96155c2c7c19cc7d1b1f4c00.exe
File opened for modification	\??\c:\windows\system32\dllhost.exe	JaffaCakes118_6944912b96155c2c7c19cc7d1b1f4c00.exe
File opened for modification	\??\c:\windows\system32\lsass.exe	JaffaCakes118_6944912b96155c2c7c19cc7d1b1f4c00.exe
File created	\??\c:\windows\system32\ficecadi.tmp	JaffaCakes118_6944912b96155c2c7c19cc7d1b1f4c00.exe
File opened for modification	\??\c:\windows\system32\alg.exe	JaffaCakes118_6944912b96155c2c7c19cc7d1b1f4c00.exe
File opened for modification	\??\c:\windows\SysWOW64\lsass.exe	JaffaCakes118_6944912b96155c2c7c19cc7d1b1f4c00.exe
File opened for modification	\??\c:\windows\SysWOW64\Appvclient.exe	JaffaCakes118_6944912b96155c2c7c19cc7d1b1f4c00.exe
File opened for modification	\??\c:\windows\system32\diagsvcs\diagnosticshub.standardcollector.service.exe	JaffaCakes118_6944912b96155c2c7c19cc7d1b1f4c00.exe
File opened for modification	\??\c:\windows\SysWOW64\fxssvc.exe	JaffaCakes118_6944912b96155c2c7c19cc7d1b1f4c00.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\microsoft.net\framework64\v3.0\wpf\presentationfontcache.exe	JaffaCakes118_6944912b96155c2c7c19cc7d1b1f4c00.exe
File created	C:\Windows\_bmp23_.bm_	JaffaCakes118_6944912b96155c2c7c19cc7d1b1f4c00.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_6944912b96155c2c7c19cc7d1b1f4c00.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
668	Process not Found
668	Process not Found

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1516	JaffaCakes118_6944912b96155c2c7c19cc7d1b1f4c00.exe

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6944912b96155c2c7c19cc7d1b1f4c00.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6944912b96155c2c7c19cc7d1b1f4c00.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System32\ooknqafk.tmp

Filesize
1.3MB

MD5
a3fd37a34cf0832da3f4aee82c641be8

SHA1
d0fb95186a71d1810bdfd15cf67d9e32e1b98346

SHA256
fca2c6bd24ec1e6f3860b415d0554241dae13b467cd1200e6246899b59b74d16

SHA512
08c7b0b11babf526b5995387f2d65d6d371756c954f8ac7a7f9117b3f53c9bd815c04f944ec9352464c71d44d1590124feeef9797243ea406b849b5697af4fcd

Download Submit
memory/1516-0-0x0000000000400000-0x0000000000614000-memory.dmp

Filesize
2.1MB

Download
memory/1516-1-0x000000000041C000-0x000000000041D000-memory.dmp

Filesize
4KB

Download
memory/1516-5-0x0000000000400000-0x0000000000614000-memory.dmp

Filesize
2.1MB

Download
memory/1516-17-0x0000000000400000-0x0000000000614000-memory.dmp

Filesize
2.1MB

Download