Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
02/06/2024, 02:12
Behavioral task
behavioral1
Sample
8c918dc7b09518710e4c8270e2f2778a_JaffaCakes118.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
8c918dc7b09518710e4c8270e2f2778a_JaffaCakes118.dll
Resource
win10v2004-20240426-en
General
-
Target
8c918dc7b09518710e4c8270e2f2778a_JaffaCakes118.dll
-
Size
30KB
-
MD5
8c918dc7b09518710e4c8270e2f2778a
-
SHA1
6703c8e8f4e1a828d11f6899ed3dcaa149bd5172
-
SHA256
09c797279602da4592f01c66fe442eb30feeb61f34ced8e38816ae18a8cfc7b0
-
SHA512
ab46a739a18c471ad95bfe26c63c50d3f37766969d450d821cea83e5f0f3fb013a9291864bee86ed6aeb25a126dd59c099e81b4135c63c57b2bf7ee0010a0b23
-
SSDEEP
768:gKsRswq8lczikS02wYnElSMYVarkrKFZVPqN9:ZDOMYWfkrKLwN
Malware Config
Extracted
hancitor
1812_78213
http://unceliet.com/4/forum.php
http://fitiondice.ru/4/forum.php
http://wordlegromin.ru/4/forum.php
Signatures
-
Hancitor
Hancitor is downloader used to deliver other malware families.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 2 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4208 set thread context of 2200 4208 rundll32.exe 82 -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2200 svchost.exe 2200 svchost.exe 2200 svchost.exe 2200 svchost.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4828 wrote to memory of 4208 4828 rundll32.exe 81 PID 4828 wrote to memory of 4208 4828 rundll32.exe 81 PID 4828 wrote to memory of 4208 4828 rundll32.exe 81 PID 4208 wrote to memory of 2200 4208 rundll32.exe 82 PID 4208 wrote to memory of 2200 4208 rundll32.exe 82 PID 4208 wrote to memory of 2200 4208 rundll32.exe 82 PID 4208 wrote to memory of 2200 4208 rundll32.exe 82 PID 4208 wrote to memory of 2200 4208 rundll32.exe 82
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8c918dc7b09518710e4c8270e2f2778a_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8c918dc7b09518710e4c8270e2f2778a_JaffaCakes118.dll,#12⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4208 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\System32\svchost.exe3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2200
-
-