Analysis
-
max time kernel
150s -
max time network
133s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
03-01-2025 12:31
General
-
Target
JaffaCakes118_6ca5505f322f8c6759c5e891d2bd3ec2.exe
-
Size
635KB
-
MD5
6ca5505f322f8c6759c5e891d2bd3ec2
-
SHA1
0fe3f7104b39f4ba8d83cc061b6a72daa6600e55
-
SHA256
7a2f7b0ea747b6d3d8aff4cd3ffc73f1b96eb177b54c97528dfafa72a71a2941
-
SHA512
177a63d3b74add8b5be5428dc16bbfeb267ac3199f489745c1cb2a928402c0407c543a6afb07c1eb936ce1c96bef9b279144a0954f4a7c9ee6d38698384d8263
-
SSDEEP
12288:7fjA+bhgvqBsC9SMNako58dEZNeaf9CuAhdX/nomc2zmEGTaQ:TXyusC9SYvo5xG7iVTa
Malware Config
Signatures
-
Expiro family
-
Expiro, m0yv
Expiro aka m0yv is a multi-functional backdoor written in C++.
-
Expiro payload 1 IoCs
-
Executes dropped EXE 6 IoCs
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Drops Chrome extension 1 IoCs
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory 61 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 4 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: LoadsDriver 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookAW 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6ca5505f322f8c6759c5e891d2bd3ec2.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6ca5505f322f8c6759c5e891d2bd3ec2.exe"1⤵
- Drops Chrome extension
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookAW
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
-
C:\Windows\servicing\TrustedInstaller.exeC:\Windows\servicing\TrustedInstaller.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.0MB
MD520df672055e76ff294562fedaf805027
SHA16e7e8d6322b8e0aa08c8735c6cdf3609de18c41a
SHA256697bf9e83a50c8b801a7ba0bef1559d5d06027de29aa53f1f5f31e8ccb694c84
SHA512aace4cd4fab2eff4e875c69edce72f9b103448f7400f16758b4b0b4a04c17b1dde9a605e90e79ae5934aa02b7e2816103e3b87cb4fd4e347270a5fc3df3fedbe
-
Filesize
723KB
MD530e6438891265cf5e38cae8d22978f0c
SHA154275ee54443c382dedf0896bf05b582f41f2cba
SHA256812d3daa8906e7ba4ee24c602adfffccf6f7417ea55eed808645b283cf0cd3e0
SHA512b14789f320cb5e12a7d2dc5a4d98e241c5666bfdc1eb6a9258ef77cf0e569b4b838aabd08222da862197ecf1f12cb0c47a6b35921592200b45e59b4c0b541be5
-
Filesize
740KB
MD5784b6483b4324f2cd7a51bb383dbe135
SHA1830294d533b5308ab301b55a4a83a6f5126c9067
SHA2561e3bc4a96fd041687e04e60602d6562d73a9ca21e5e9e341d558b3272ef27dd3
SHA5122beca346475aaa87995fc22d12b7defc3055eba7bb65893d3b46902af51dda535f48a420cdc4ff9950624001bd0057cf73d1ffc8935fa8f458ce25e5969a702f
-
Filesize
4.5MB
MD5797d2c557ee29384fb1d1db28d47fac1
SHA15dd6ef10b0061aa9949b32af2aa8196ee787e21e
SHA25636fb8b4f3c7d20f512a6abaa6caae53514275955d6d674ed4c355d4239621386
SHA5123e71a8b9ed6a02db795d6ef0e347363b3b6f9d86f2a65d0ccf9119427853a6254c207c332b09bb0054e6be11560bb3516cd1b71e419191e060444445777d999c
-
Filesize
2.1MB
MD55fe3d424363a257c30fc672fd72baf40
SHA1fcb8dbd9064426f6f969930184056ae226546350
SHA256273093ff530ddb3f251783b417c908e6025a30d46e5e84672e3c877e3a6f3100
SHA51278a329a0a09e9a5e2120b121ce0bdc342a0b1e62ca1554143772a57975918cd08017bbdb722efd17ae07671031c4666ecada22b3e3f4d0de7b250e041507084e
-
Filesize
1.3MB
MD5a5bb17c9340f94d73497ec8befdb9fd4
SHA12201dc51e115093912980be93827fbbe5b299c4a
SHA256988dbdce39ae695495e7c3395dfd46b6254a8ef02fe62655a6c032c58829e3a1
SHA512bb1cf509891e966b7063ba5706190f8a08dcaf8b4e6e496c66e1594cb61daab73dfbe07225da57b9a99a2fde560294ef36c3fec2809d776bf20b800fe823a3b0
-
Filesize
923KB
MD5198d408f371b6723ca27aba9904e319a
SHA12cb4e6219f096d6bc9097970472e0ad5ac8268f6
SHA256c743fe8f3d154f653a3d2af5f04e90e86bd499ad981727626a04d49706d1cc87
SHA5122c8594097f9c494cbb0b445fe03a2cc6168d04f0a2d60c0db8f88fd4ee745d0df53ba86a9ae68ff20949e4fc361cb209163a583ce4acf48d2d6970c079296914
-
Filesize
1.2MB
MD51b65c560a3947108450f4fe0ff3309a0
SHA16d72ead0a90d454f22ab9e421c17c1251afd4485
SHA256d3e105b8b89a6fd7fb315c7d4de23efb3d0cda48d293ad2740185637fe5fd188
SHA5127478ad6763425efd919be83d31090501e76ae22c8c87967af866eceb5a4f40e2c702c3bc68bf7fcab6032a9c724296797ebd884b40277ec5526376b214cf7472
-
Filesize
874KB
MD5dd94cec22fd61bd29c96e10046bdd7fd
SHA12f2caf0414c10836ef7afaae547dd0555384f5e9
SHA2560792cda06683bed71ff90222eedbcae774c5d5b72ce275499c6f7ae55fa3fe26
SHA51277a53d4ddd7f37f0d1d645f8e07c691ac89c84636988eccbc9e859df22e4e150ebddbd9b1ddb9cf049c58529f779cfdbd3043ffc4e6eb32fc25d32ba75af7208
-
Filesize
193KB
MD5805418acd5280e97074bdadca4d95195
SHA1a69e4f03d775a7a0cc5ed2d5569cbfbb4d31d2d6
SHA25673684e31ad4afe3fdc525b51ccaacc14d402c92db9c42e3fcbfe1e65524b1c01
SHA512630a255950c0ae0983ae907d20326adea36ce262c7784428a0811b04726849c929bc9cea338a89e77447a6cec30b0889694158327c002566d3cf5be2bb88e4de
-
Filesize
3.4MB
-
Filesize
4KB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
2.2MB
-
Filesize
2.2MB