Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
139s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
24/08/2024, 04:08
Static task
static1
Behavioral task
behavioral1
Sample
bddc5f04aad68310e04f3e32122ed8ff_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
bddc5f04aad68310e04f3e32122ed8ff_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
bddc5f04aad68310e04f3e32122ed8ff_JaffaCakes118.html
-
Size
44KB
-
MD5
bddc5f04aad68310e04f3e32122ed8ff
-
SHA1
cb7bf95fbe4082262a6e7af261c5220dbdf6e02d
-
SHA256
4eb6f39a8569759eb58e2b34129efa0641739ec2d476f8bf678d40291279b476
-
SHA512
ea32037b23b5f3d028de8ebb2ac1f4d4aec12df414170db82000823e05f8de2c0d05146081c28b595f899d67ff42da22d3a4d78df4762db72626883429c68181
-
SSDEEP
768:tncOWPOLOpsxHOT61DKpB3gGJ5Sm00sgsy6E5TED/kDat/Hnm/ud886awJwfB8Ov:tnTXKl4KpB3H5SD6Tk/nvSvQBzzQS
Malware Config
Signatures
-
SocGholish
SocGholish is a JavaScript payload that downloads other malware.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7AC6E0D1-61CE-11EF-B913-D2C9064578DD} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430634360" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2380 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2380 iexplore.exe 2380 iexplore.exe 1920 IEXPLORE.EXE 1920 IEXPLORE.EXE 1920 IEXPLORE.EXE 1920 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2380 wrote to memory of 1920 2380 iexplore.exe 30 PID 2380 wrote to memory of 1920 2380 iexplore.exe 30 PID 2380 wrote to memory of 1920 2380 iexplore.exe 30 PID 2380 wrote to memory of 1920 2380 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\bddc5f04aad68310e04f3e32122ed8ff_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2380 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1920
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
854B
MD5e935bc5762068caf3e24a2683b1b8a88
SHA182b70eb774c0756837fe8d7acbfeec05ecbf5463
SHA256a8accfcfeb51bd73df23b91f4d89ff1a9eb7438ef5b12e8afda1a6ff1769e89d
SHA512bed4f6f5357b37662623f1f8afed1a3ebf3810630b2206a0292052a2e754af9dcfe34ee15c289e3d797a8f33330e47c14cbefbc702f74028557ace29bf855f9e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize1KB
MD58123682d406a28322ade5bfa795b0cc8
SHA1c0ee62e0c466f5451973799d87181c973f5cf9c3
SHA256c2296956cfb398a5a2e3a711a6cc07dfce58240e3a9d169a671cf2fd2e802d11
SHA51220f6302db3071a36a26c0d57c8e9f7f534b5ec55283d4317315283402434f20615e487a8c37d0a9552040aa22d4cb356252d6705dcde3ce97fef962a5f314686
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B3513D73A177A2707D910183759B389B_147AB4536A182B9FCE88E194D59F3B22
Filesize471B
MD5af5980f62152bde41ba17b450bf4ea15
SHA12a364f2ab350ed65ac5609811c072c6f0ed677dd
SHA256c670e4c51807b5cb1b0b3b50b732d767d221ff55be3aace256579901788a5df6
SHA5125e059ddab576a166adfdd280c7adb20e3bd294acfd19ba2af76ba96c51fca54eeb8075946b871b86560cf5e622acc1d63e714bd5c692114c7c12d537beee92a4
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199
Filesize170B
MD544e8246c1bb248d90fd48975dd122265
SHA1959f80affa10abf54f02b7e18b28895469dda89b
SHA2561af1dbe15db600fa01c744708c9a3a60c8cebeddbebb4ef3695c9118342ba77f
SHA5128c1fa34e20409a097f046d3101c519e7ad1c0c2c6ec88ed24bb655bf166ed65addba1260e42200c15c7b2447f4fb829378e88feac5904c3bf9e99204335b6239
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199
Filesize170B
MD5dc79b0e9ca9f441c9b3d068b5f107a0a
SHA1c19bf8cd6ac38967721851055e2016c7c905c246
SHA2567bc5f564fbd961a62ae6ba0c6961bb4fff9fbbed2e467d66580f2f22f5997a73
SHA512af5a050ab3bbb1e50da1ffc0d7843519c8573c6ec7a6cf6c8b7465bd89716f04cae76b8b8b8c5fd7a0018970b12e82e66d3db72febd80b3fec54cd8e7b3cd277
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize410B
MD5571030f334ce249fe6bd7290a87b07a0
SHA14eac815c6f5a84394a7dc33070e765b7820d739d
SHA2560d4ca317a41e870e3ab8d9f03abc79c086f66cd0d93c18352ef8ef775d8f2031
SHA512be5cc66ba8d5af8245906c73194bea515f00cc82850ffc83390f26f67a977e4d59f3f94e4dc48c6c9db40f0a83b88de5fbc8968db37a24efd994bb1b081e6776
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize410B
MD57f2c20de90553f494b6b281c256709b6
SHA19c2c5fca72126f1a96553b57377101a0fb7b5664
SHA2567e522cafc885f94d2f2b3922d6eff63c3828768c9be5b579477ba595227de654
SHA51237b642b2e8d3ba4c9b46381927e46e9f10bd8fe176d7baa61b65bcd88c77884b1d276bb2dab5b20cbef9617a6f84c1799f72be67412367fbe2560965722c57e5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD5927653f78eccdcd7dd23c58534657c65
SHA1af1a92eb7bc11c9d37b871ac35d978f30c3faa7f
SHA256b044ce81dbd85d9877fee3c601e75b6d90ce3a9610771989f54b1e9d9c226666
SHA51275073ca4e0f636bb9a2b2a78eaf9ecb60c20d8c885ad0dd39b6eaa24362899463ce633916a4132426582e345b7de98798219e34aacdc1662e76b6dac3909cf8c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55b7d5ee862baf625d94eb3766d0ce62d
SHA14629979019f3e8d015643dae1ce09f8e9069b9ad
SHA2569788f988e018f75fa62879a93c3dc9e48e2470d0641ab10a100162234a9f511b
SHA512c01d6dd600fb51c954cd7863cf4b0a78d46f6e4773b9bf36702d7b844f12fb408a10664adb0bbb80452e441bc293986036c359cdb1ed7d7773212c998c77b910
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a7b6103a1cdf5b111a4294a247eb1532
SHA1fbfd79aca215230e65957621a6ca8ab27efdb097
SHA256b4452f5dab9387ccb8adf8e51bc6af01d517cd3aa23436de1fde7cee2d752208
SHA512968f0d9a239b2a0364aec2b2c5a4c7b85600109de848502c431262f3d256f07ac000b3ccb2ecb266939f6e7591e9e6ab2d32843a9a3ac01de6bd17e6dd552c39
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50771fb174c31cb85e7829367afbf1762
SHA147ad29136a3283adc9af3da76c1c845ccf080d43
SHA256139848261914e7df18b1d5a451348c1b3ba4d7a73a453d152371ae559f726d70
SHA5125181b1a97b6a447eee0e75a606d757e862d5a48667e08113b0edb9cfa9dd7e28ac814abac8e81e1f1b3a3c6efa4a2404f9577705b7c7810989cd7d68477e49f9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c704b279dc4b424c3e46947b78168f02
SHA1242fa929088ec931c1846a823c4d7c56be9c8c4b
SHA2562d92371221d356234ba7a74383859a3acab58e3c1fbcf8c60892f2892f97cfdd
SHA51288c1d494f9238a412f4a5cf73b07ce3a453863b870ffd1655bbe8571418c1f793e6d8fad28c3f75d4b061f1daf82d15c3954c5c4d1e9a80ab58270c80927a682
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ca56c63dfe91c771edc666d290855c63
SHA10d9957b16254159b6d40653585c47221ffb5d45f
SHA256739b234aa0f30222d5b45f9d80b41bb3f84b7887b782c16011f1c29816163857
SHA5128634b97822b200d42293adb8f02af0aa60fa90bad26cd7f08d11aa2063033e91fda1956adde381283c20a8507e7c4adf3c572a5f25b5d892574ea38efcf7134f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b20581cf788c69ae1c934044d511c28a
SHA1299de4fd8264c6543d865674c53c31792daf77e9
SHA256e7cee29faa047e19c2690a172a937245c1eb266da1382c1a3200eab238c81349
SHA512b076d039af254ac728ca3ec8de736aa757a82908bae7a54032e097906709e346eb51f64a5b7fdfd02ea1201f834f1114c0a2ef1bf65e6c1f40238e4c28749142
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59700f200c7ab6f8e3ab7ce30ca9a7118
SHA100280416a376ddf6f5ae41456baff6c713d06d4d
SHA256b772d3a38877d3ee6693a4a3c6418c808ff30cf4dedc6fc2b8e00e3087feaed2
SHA51299304fcef94c3333178aa8c7cf11dbe0e32cf86f3530416fbc6173febebf8ebbe4d4a2fae12e96f149603a4b4bafa777a82c9bbbf5fbb1321cb61e921d2d3dee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD521eed1b7f355630e4e636744e487cf2a
SHA132cb493e88510db6c3e6a635fd5a50c69ec3c092
SHA25667259cc9190378c6bf13fb2efd8a2f3ca955077e122dc0c9ca080a3a75276628
SHA512888755ee09f7899a25b9a680549c3e87669ffc8d21c5e7d637ad679c653c0be301dc6de0addda4db8410d0049d1d94a2e6a301f44382b99da9bd660147ee5eab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD536884fdcb19ebedaf287c19f33409013
SHA1b8c495e6860360415bed4cbf63d6dada0cf120a8
SHA25608d2c4022c037ec09aa4f0e8a0d53e6a8bceaa672c1f374287e14e08d64366c8
SHA51280d78ccbf78106c1438d5fc8ac28f786f506a5b25a252f38dbd1774d72638c46aac69778fa540568f812642b62650319bfed874b04d3be11e71ce7938940ca6b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51a8ffbd9ad3c45e1704bc77de0772c8f
SHA1af01c4c465360fdcebd8afc91bedeb42ea080c6c
SHA2564ce1debcd686f5d3c6177ff356d9d030700702049ba40887ada9ca01e93322b7
SHA512d15c519e82d74536eff2b421f0773af1a3b8e80eedd7c147f65bdbd4e4458c75f531299f7392874d415e32e7f087106f14d87a11d0252e8a3245ac02a2c5f81a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e712c0a415df5b4225fd74e575c46e0b
SHA1ee5cb9b7f0796cba6f4c04a9b1277589dc1b2ed7
SHA256084d08de51bd70c3cad476306d5270f0e42b60ac5ff5b143901cebc1ae4c19cc
SHA5127d6784c122d520b54ec4d28f4988dd11acbf640c4166341738ae4ef0ed3797d635b5da99dd1cd25d58602fef8c520a5ad0b3719ea2e835eaa4638b3e45e63490
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56a6ecf0c2958a51cd25b35b428b65459
SHA100cebac669934d1779c82b839988ef7b0b8b3c3a
SHA2567871067e4e40348aee8ed6ff630867ec5f62d6a0a858bf1f3578faa128c7eb8c
SHA5124bf4eeddd41e72325a8a35b7cefb8d7577b449c7dbd220fb9c05a3082c273c9c29b4eb82ba4985e9197267e3592ab05d5231e820d0b29d6d5fffe43285ad28e6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B3513D73A177A2707D910183759B389B_147AB4536A182B9FCE88E194D59F3B22
Filesize402B
MD5ba2b3818ada110660976f653dfede648
SHA1df88f9641bd204935db9481f015fece2af02cb80
SHA25603edf112f14af4e2f384a2dba08aabe80d18ad7a2dd6ba8ff54a49ea645e77e1
SHA512d99d6cfdf89feab2ad013d1977aa4495218a40f76653ce824c6134b3feb2694fa536c8b1dabc924b73151106b12271cdb98bde5fb1b37f76d6b172046d81b038
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD5316afc5afa3ec89c967257fd63282fb8
SHA137146fbd9df2a114456cedd2bd025cad83e457f9
SHA2567480e06bea2ed5e65ad0453051511e157c4fd8abafa17e2fb586f04cbb94d704
SHA5122ac43949002684cdfe71895bd2a1a466b528204cbb7508e946315167eeb2d6e719f0361f12bbab628bbd4f10bbcd913a5f51db80c5eb63f4c198bcbdd2b5841d
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b