Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    138s
  • max time network
    145s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    07/01/2024, 19:26

General

  • Target

    abed38ce8f0c66221854bfe9ea287353.html

  • Size

    34KB

  • MD5

    abed38ce8f0c66221854bfe9ea287353

  • SHA1

    7809ac729e896f4a9aa55f414d4b1c23ad0b5fdd

  • SHA256

    09663d35a384c1b07f43f689aca5c879d5ff09a3d57d8ffdaf7075f72f3b413b

  • SHA512

    be6c3ebe1563951ffb2d1239d06ef44fda5a6c7d02f9456c0c4a430d33f29921936754e61a0d0eb6c8b9952f221e68634f98b42fabd9622d475a0472405fa306

  • SSDEEP

    768:dfKn74o711KKTH7TYF+cPHBN1UTpXN6I1/xUPvtiVX:JKn74C1JTH7TYF+cUNxUPvE

Score
10/10

Malware Config

Signatures

  • SocGholish

    SocGholish is a JavaScript payload that downloads other malware.

  • Modifies Internet Explorer settings 1 TTPs 36 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\abed38ce8f0c66221854bfe9ea287353.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2224
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2224 CREDAT:275457 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:2180

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    fd4409e0985e4467c1eba32acecb0340

    SHA1

    cc1b6b5d95f042060d801691a81ad174c644ea2b

    SHA256

    1105ffda36b5ce8c87aec353827b7d6cbecc3c0613da06ea8ca45990602047c0

    SHA512

    183b60d7eb0771b80d4f0f97e1b9563e980f8636826a9ebe513dd5d303562292a38b30b5d37cb8508585e7be563f45fa5f3ffce36581d6002ea216c4551629c8

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    64670181abcae9cd2f6b509675c090bf

    SHA1

    a84de6724c88bf9e784386892425bf1f34157400

    SHA256

    c751e28b633fa3496594637e2e763517ceb564ae923638aaee5af191328b828a

    SHA512

    77180a010c5e74075e85b5f1c0382f4dcd57721ce4b8c35241ac99a3ab13fc259fdee8ebb01aad7ddf09d4b8161adbc90fc4d25a050f92988c5fb843c3999b03

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    65b250e96343794d23dc4fd93cab7890

    SHA1

    69f11f1f2143c59afc5cff645812cca66925a74d

    SHA256

    22f4714ece794ad595d7da266aafdf4c99db48ff24633452b1efb785570b8eea

    SHA512

    45921481f83f98141e4ba6f6524fb90588535cab9cc02aa2b5084beb9453399c14c6035b91b592f31a42c789810a3703d12602500904559890ee0d33f1d1a2f0

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HVBRC7A9\geocompteur[1].js

    Filesize

    5KB

    MD5

    81ed28d9fc91f371fb9e7382b6199d89

    SHA1

    12a76d4c612ee762f551fd620c454bdd7bcf13a7

    SHA256

    3316412a1c6da1ccfdec86cc8bff284bf165f112d07e586ee200fc803a0439cb

    SHA512

    4425d45cff8233ff23b0bd3e46d7ccd13d6d0b8bcf16d4c723e205eb45c609243f92626048fb7a46c33cdadb2241c3dc3544fcd24d8e17621f6bfcd31a46a90e

  • C:\Users\Admin\AppData\Local\Temp\Cab3A83.tmp

    Filesize

    65KB

    MD5

    ac05d27423a85adc1622c714f2cb6184

    SHA1

    b0fe2b1abddb97837ea0195be70ab2ff14d43198

    SHA256

    c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

    SHA512

    6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

  • C:\Users\Admin\AppData\Local\Temp\Tar7535.tmp

    Filesize

    171KB

    MD5

    9c0c641c06238516f27941aa1166d427

    SHA1

    64cd549fb8cf014fcd9312aa7a5b023847b6c977

    SHA256

    4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

    SHA512

    936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06