Overview

overview

10

Static

static

3

JaffaCakes...8c.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_aeacd6bfb480546d0ee3e14f0bb46f8c

  • Size

    816KB

  • Sample

    250105-tbkbes1jhq

  • MD5

    aeacd6bfb480546d0ee3e14f0bb46f8c

  • SHA1

    05574783017260e4d3dc0ca831161b5cabf51c30

  • SHA256

    3b6c6c2a764d8fef59455935fa43ac30fe7db543d13f6119a62c5b14faa87325

  • SHA512

    6aa7e58beb9923690918de0c3634bc6ec170dff647fe5a381604b3e28c6f74ff5e12424175acecee21bf419f66060fd562d48a47ba72703c39e2b4aa0906e6f9

  • SSDEEP

    24576:BJW2KjJ4Td3kJnbsPhnzqpKZdhRcloe4Mmz5:BInJ4Td3mbsPhnepYhRclkd

Score
10/10
expirobackdoordiscoveryevasiontrojan

Malware Config

Targets

    • Target

      JaffaCakes118_aeacd6bfb480546d0ee3e14f0bb46f8c

    • Size

      816KB

    • MD5

      aeacd6bfb480546d0ee3e14f0bb46f8c

    • SHA1

      05574783017260e4d3dc0ca831161b5cabf51c30

    • SHA256

      3b6c6c2a764d8fef59455935fa43ac30fe7db543d13f6119a62c5b14faa87325

    • SHA512

      6aa7e58beb9923690918de0c3634bc6ec170dff647fe5a381604b3e28c6f74ff5e12424175acecee21bf419f66060fd562d48a47ba72703c39e2b4aa0906e6f9

    • SSDEEP

      24576:BJW2KjJ4Td3kJnbsPhnzqpKZdhRcloe4Mmz5:BInJ4Td3mbsPhnepYhRclkd

    Score
    10/10
    expirobackdoordiscoveryevasiontrojan

    • Expiro family

      expiro

    • Expiro, m0yv

      Expiro aka m0yv is a multi-functional backdoor written in C++.

      backdoorexpiro

    • Expiro payload

      backdoor

    • Disables taskbar notifications via registry modification

      evasion

    • Executes dropped EXE

    • Windows security modification

      evasiontrojan

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks