Overview

overview

10

Static

static

3

JaffaCakes...e7.exe

windows7-x64

10

JaffaCakes...e7.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_209d63407414998cc52db23fa8471fe7

  • Size

    406KB

  • Sample

    250106-ngfmjaxmgr

  • MD5

    209d63407414998cc52db23fa8471fe7

  • SHA1

    f06e068ae256f9dfcd3926958d9964d61f8cec2d

  • SHA256

    99826ece45610fbe772e96c3978a4a120da6ad8138af4d56b26f0b5746cc8d53

  • SHA512

    e900064b2f40ee03070f921104a87bfd06fddfd52866c64053c26b5ec51f20417dccf82cc4482c5168f7d58c34094e054e88017d25db458a00763c4f10563b9b

  • SSDEEP

    6144:/Izfx0tsmxGjd9suGj0IDhAJSbnVrw8/LppZ2oqIqOEhspJ:+fqOwGTlWnN0Qrw62obqap

Score
10/10
expirobackdoordiscoveryevasiontrojan

Malware Config

Targets

    • Target

      JaffaCakes118_209d63407414998cc52db23fa8471fe7

    • Size

      406KB

    • MD5

      209d63407414998cc52db23fa8471fe7

    • SHA1

      f06e068ae256f9dfcd3926958d9964d61f8cec2d

    • SHA256

      99826ece45610fbe772e96c3978a4a120da6ad8138af4d56b26f0b5746cc8d53

    • SHA512

      e900064b2f40ee03070f921104a87bfd06fddfd52866c64053c26b5ec51f20417dccf82cc4482c5168f7d58c34094e054e88017d25db458a00763c4f10563b9b

    • SSDEEP

      6144:/Izfx0tsmxGjd9suGj0IDhAJSbnVrw8/LppZ2oqIqOEhspJ:+fqOwGTlWnN0Qrw62obqap

    Score
    10/10
    expirobackdoordiscoveryevasiontrojan

    • Expiro family

      expiro

    • Expiro, m0yv

      Expiro aka m0yv is a multi-functional backdoor written in C++.

      backdoorexpiro

    • Expiro payload

      backdoor

    • Disables taskbar notifications via registry modification

      evasion

    • Executes dropped EXE

    • Windows security modification

      evasiontrojan

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks