52d0f43e284c6d1196b79110911f4998a44cccef6166dcd12b06fea2687e4c01

General

Target
jaffacakes118_Trojan.Win32.Gentee.l.exe
Size 71KB
Sample261018-v4fdlsft7n
SHA256 52d0f43e284c6d1196b79110911f4998a44cccef6166dcd12b06fea2687e4c01
MD5 3ab7fce8f12800b1ddab768b406252f8
SHA1 2f5b43df3e3b1f96ac0536cc49798a3d94b31611
SHA512 4c8d18c69db96d937d2acac8abc32ece82bf144d847e9723c7d37a5b346718b2c5b26503f5d58712979d86ebd6e41990abd94ead4f761c53a7cb6d0407e1a466
SSDEEP 1536:jqUeWICXS+WLAaH+iFtQIkVBCJ5gyNMIUKoliKSnpcY0:jDeZ+WUaHjtQIsO1/EiJpcY0
TLSH
T1DE63F287AE9185DAFA584E7B1BF706A43BAC14F22556476FED63724F20E3E306243704
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 6 IoCs

pid	Process
3180	Exp1orer.exe
5456	Exp1orer.exe
5684	ovram.exe
2536	Exp1orer.exe
2616	ovram.exe
5540	Exp1orer.exe

Loads dropped DLL 3 IoCs

pid	Process
4664	jaffacakes118_Trojan.Win32.Gentee.l.exe
3180	Exp1orer.exe
5684	ovram.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Exp1orer = "Exp1orer.exe"	Exp1orer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Exp1orer = "Exp1orer.exe"	ovram.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Exp1orer.exe	jaffacakes118_Trojan.Win32.Gentee.l.exe
File created	C:\Windows\Exp1orer.exe	jaffacakes118_Trojan.Win32.Gentee.l.exe
File opened for modification	C:\Windows\Exp1orer.exe	Exp1orer.exe
File created	C:\Windows\ovram.exe	Exp1orer.exe
File opened for modification	C:\Windows\Exp1orer.exe	ovram.exe
File opened for modification	C:\Windows\ovram.exe	ovram.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan.Win32.Gentee.l.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Exp1orer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ovram.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4664 wrote to memory of 3180	4664	jaffacakes118_Trojan.Win32.Gentee.l.exe	87
PID 3180 wrote to memory of 5684	3180	Exp1orer.exe	91
PID 3180 wrote to memory of 2536	3180	Exp1orer.exe	92
PID 5684 wrote to memory of 2616	5684	ovram.exe	93
PID 5684 wrote to memory of 5540	5684	ovram.exe	94

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Gentee.l.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Gentee.l.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4664
- C:\Windows\Exp1orer.exe
  C:\Windows\Exp1orer.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3180
- - C:\Windows\ovram.exe
    C:\Windows\ovram.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5684
  - - C:\Windows\ovram.exe
      C:\Windows\ovram.exe
      4⤵
      Executes dropped EXE
      PID:2616
  - - C:\Windows\Exp1orer.exe
      C:\Windows\Exp1orer.exe
      4⤵
      Executes dropped EXE
      PID:5540
- - C:\Windows\Exp1orer.exe
    C:\Windows\Exp1orer.exe
    3⤵
    - Executes dropped EXE
    PID:2536

C:\Windows\Exp1orer.exe
Exp1orer.exe
1⤵
- Executes dropped EXE
PID:5456

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Exp1orer.exe

Path C:\Windows\Exp1orer.exe
Size 36KB
SHA256 afb7cda11240a1762da305307baed2361e212c08ba736593f0a14542e6626009
MD5 9d013e01004103843a7d17cf2b2c6af6
SHA1 2dbdc821943e2421fe55094fa362aaa5760d7b4c
SHA512 c91e80d8b2881d23b7469c1c76c5525a8514625c15e78dbc79f0c370325116e30d28007f0c00db3c436701287aaa0d41be3f5d1246c67bfc3afcb46323f42cea
SSDEEP 768:dZqAxZnvjD0VWICXxM+WZh7MZgww4kDvqsyUaIYcuKuSF:/q4eWICXS+WLAaHpy/tcso
TLSH
T13503D00EDF8196BEE1CC4DB625E76DF8367528A261A78B4BED23B36F14336119203340
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ginger.dll

Path C:\ginger.dll
Size 53KB
SHA256 7893685c9e43db19515384cad39b8bfef30e29e1081da2db38cd744cf1292a4a
MD5 bc6b81e08f5b0b92af351e6fdec5dd51
SHA1 828a0b69b35f2de891b5e18472c16d534c634048
SHA512 c5871258425331581e159e75429790fbe6019f176975c0cb736b090129e11373ab4da259c38434dc95581af1c419a04c50cf4eae4c1d754fe3dbfefa9201d71e
SSDEEP 768:FHkUYoVhDU3EATt3fmoxlxCYjZ0NZU+IBtFkw876kHXoVbh80Bc8CJBwIDjuSY4d:eUZVO7JvNH8NZU+agHYV/CJBwIDjI4d
TLSH
T1CE336C217211D4B3D9E5027D24DA171366795C3037A86543FB535BAEBCF02E2FE2A22B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ginstall.dll

Path C:\ginstall.dll
Size 53KB
SHA256 32bf882cf9cd116015d0d9922ef2e001ee2af11cdfa2f9390cd329a16854a981
MD5 c9814e9ad1f24ad9f3e1637838e6d761
SHA1 ffcb081a8fb5370d388ba12e71c204705d188182
SHA512 2ccd9dc7b3b5e9e61c7aef7df6aca71a94026194bacd49ccc8a7f07ee08eda9c864a0e5b8617dea20f714eee6f6416009be82772dd4a04ad30ea96b7ad25a112
SSDEEP 768:FHkUYoVhDU3EATt3fmoxlxCYjZ0NZU+IBtFkw876kHXoVbho0Bc8CJBwIDjuSY4d:eUZVO7JvNH8NZU+agHYVHCJBwIDjI4d
TLSH
T116336C217211D4B3D9E5027D24DA171366795C3037A86543FB535BAEBCF02E2FE2A22B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads