Overview

overview

10

Static

static

3

JaffaCakes...24.exe

windows7-x64

10

JaffaCakes...24.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_cb69584111a561a5896145438b009024

  • Size

    88KB

  • Sample

    250119-ssjksatpfn

  • MD5

    cb69584111a561a5896145438b009024

  • SHA1

    5a05dbfeb616acbe102d3ad1f9ff5387e2c50bdb

  • SHA256

    28aad1239f02b00a79a7ae67feca4f9b41d8ab40710855b2142d03c81500b422

  • SHA512

    9e5b060dfa66ad7743b3e7602b2d45255284b47cd2a2809889312de6d92c74ca771346fa815f4b95d917dcec4fff89f593861f34f04e260003b714b112a3a056

  • SSDEEP

    1536:XXPeXonnUStQXDI4spvVp+N8NECtH3/ItaRmtmhDA2B/w:XAgnUStM0BFn+N8FP2acIhDp

Score
10/10
expirobackdoordiscoverypersistence

Malware Config

Targets

    • Target

      JaffaCakes118_cb69584111a561a5896145438b009024

    • Size

      88KB

    • MD5

      cb69584111a561a5896145438b009024

    • SHA1

      5a05dbfeb616acbe102d3ad1f9ff5387e2c50bdb

    • SHA256

      28aad1239f02b00a79a7ae67feca4f9b41d8ab40710855b2142d03c81500b422

    • SHA512

      9e5b060dfa66ad7743b3e7602b2d45255284b47cd2a2809889312de6d92c74ca771346fa815f4b95d917dcec4fff89f593861f34f04e260003b714b112a3a056

    • SSDEEP

      1536:XXPeXonnUStQXDI4spvVp+N8NECtH3/ItaRmtmhDA2B/w:XAgnUStM0BFn+N8FP2acIhDp

    Score
    10/10
    expirobackdoordiscoverypersistence

    • Expiro family

      expiro

    • Expiro, m0yv

      Expiro aka m0yv is a multi-functional backdoor written in C++.

      backdoorexpiro

    • Expiro payload

      backdoor

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Modifies WinLogon

      persistence

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks