Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    135s
  • max time network
    131s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    09/09/2024, 00:19

General

  • Target

    d55b45cb090d7cb09aa7adb20e832a43_JaffaCakes118.html

  • Size

    102KB

  • MD5

    d55b45cb090d7cb09aa7adb20e832a43

  • SHA1

    bd8963be857065cc45d61d27c3b9612017bd2cf2

  • SHA256

    8dce99eeb253809f9be41575ffb677fc96d23801a6a64e7f52b3b441df06dc62

  • SHA512

    f0cd075df3c573fd463b66e91368758c54f6ab24c3a475e2f9a5e88bc8f8dee505c3f9d253a99ad4f86538510a1317895e598eedd5082f5aa2ccb81a86139327

  • SSDEEP

    3072:0ZkOfreJtvjpuFYpZvyCAMEFd5JBBtWbBxaisJ86P:7OfrhYpZvyCA37

Malware Config

Signatures

  • SocGholish

    SocGholish is a JavaScript payload that downloads other malware.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 34 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d55b45cb090d7cb09aa7adb20e832a43_JaffaCakes118.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2400
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2400 CREDAT:275457 /prefetch:2
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:2780

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

    Filesize

    1KB

    MD5

    3cc509ca4be348bfd22e7c172d7964cd

    SHA1

    db89db55d0ac8cc9e00288edf57b6d231f83e029

    SHA256

    77b18af1247f6fd10404ccc1b7062e30aeeee89cc50340dd53f32a61bfe4a7c5

    SHA512

    49ee8adc11e69b4e3f83606e8d143fc188fc024caf5bde53aaa9dc1c8495726aac6478e28c6ebf1174d83748ed5e1b89d9541402389bab1ca7a74b15533d55cb

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4FA45AE1010E09657982D8D28B3BD38E_2E1554F9937BF8D3743D83D919742174

    Filesize

    471B

    MD5

    3878190830126bf6838a6bde4f159006

    SHA1

    dedd4854a702f3ba5447751f91f179b93ab6c0bf

    SHA256

    a555cfd6a86be1c309dc918aca4a9f0f376a29fcc85fe8f16efbc8bf140d0069

    SHA512

    4577090def9b88c8f4d66cb27ad40ee081e88aa39713f40fd37cfe3e14eb8dee36d5c0567c5a7d5a0216e078ad0a66979bdc73e395aa01e19bcca2c28593827a

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

    Filesize

    410B

    MD5

    cd47e0b37e44ba8318a22a9581d742a8

    SHA1

    750f60b7a532f6e42990de1a3dd1bbaffd22c5a2

    SHA256

    256a7fc2d77e492b9b51de9302e4643a725e7376f9fe176e2cc1dbfded3d7bc7

    SHA512

    84337807e5384a42c3f9ddd43db49b0d1d6e5dd5ef42fb9eca0b69b567faafc6c9e5158dffaf6a343e98b66e8ffcbcd27f83580d54ae9421026258da352cab6f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

    Filesize

    410B

    MD5

    e08dc7d3a21545209a816ea33ca7d955

    SHA1

    338018ce8bcc07d627de64432bd2423221662c27

    SHA256

    fb018f98f90a22aaf353c1bf41a1a8656f8e955f600016cac4b156699595d76e

    SHA512

    416435e311651292c725529f073c3704e91814ecfae81e62355634e79a63691be3da1653c5c04e153a08985a1e65f9b8402c71ffda44cda13798f4df2b27b2c0

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\4FA45AE1010E09657982D8D28B3BD38E_2E1554F9937BF8D3743D83D919742174

    Filesize

    406B

    MD5

    14abb28eac0692c2bc421ededd5d86a1

    SHA1

    753980f07599a7e3a14eece02fc3e34e4f71f6f0

    SHA256

    4c27cf9734aff42cebc259682bd86345b80d5eb6d94cc861a11c0e06695eb9e3

    SHA512

    56884090e72fcc925718685cacdd750398077f84be057ddd5ba0271e64f4b707dd5d939d841faa11a1ec9c34dc02ee57dc5952f01f448a39834074d88fea4eb5

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    0340dd8dfc2026c2ff8b085ced5e9f68

    SHA1

    2a11bdd2c497a5deb056bac0f4047c7a3ad9aeaa

    SHA256

    01233b64423b28df0b769bc9ecac5ed0b439f2db4f109ac1cffba1f7845b44bb

    SHA512

    15133c6007c81f6d738d785413d776b9c5f9841cf01b923026e13dc7e678818b07b79e7cbe9b6f5db94637a8863f66f706c218885592a1c685b63644fed77ec7

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    bcd9026d32f68b2e2eba12a8c4db02b0

    SHA1

    0aab7d82d36e8f7f3bd9b6b8c2ed3dbd1db7cf8a

    SHA256

    289141738ac0ba0959d4e207137ecde5eff920bdc8685ac9f3e393e7a40b8dca

    SHA512

    314fd40889f68b26f98b6f5f8153a4aaca50d41d95030b9435835dfe52f6a348441d3a903627c74f2bfc3667829ee636b1d2e6c5bfceb351f0780d51590d4603

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    62684e5b37656c2fd9b9cd08a33d8a95

    SHA1

    65ea69a58c26d86f5620eeb7e2ace3bf9adb3d2e

    SHA256

    24a84a7f4397eac6cd9f1354131cb4b26a213cc2646187473f68ea8f03256d11

    SHA512

    41deb014f487dbc3f922a570b0cebde3f14b387246449f65af92f5e5125c9ef36ac7a76284402ae3a90e17c099c4db52d054cc4b73612a50eb9e176b118a5e42

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    7cf0587b5711d85fe8efedbd4a105543

    SHA1

    9521219a17adc6e29ce06a145046cb6d8113823e

    SHA256

    590cf0ce7a100d6e81b2096afe44fe89ec0bc7723c52fbc9b5ad4745cbb6e3be

    SHA512

    458ab01ef092615e78b82bb9170fa59b13dfd9e59f73a92af1ebf7edf55e6abe10f0d769ddfd66f5a95e5c4d73a29f53f3764a858a1a0b2df8208e4fb8bb551b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    c47567090274b5cdfdf0d29ba2b16b74

    SHA1

    791ba1c281f3687080e959022a9a6748989a96b3

    SHA256

    56cc4dd00e5492b7c48e3fe317a655c9bb663baf1d15775c872945fef9012755

    SHA512

    adf98afa177bc256a4e911747e1ddc5625ffbcbc70e67fd79451e703634584e1cc32597ee361c74493f16121ab83069c808c742f0dde1eade51535e06ad9322a

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    f9745563ab7c494fa1b2d4131dbddab3

    SHA1

    257520430904a4ec39b28400a9e087985f201389

    SHA256

    a2a7f3672a7fcc19f575185a6a1f3b7483373e4610621ebbac1e864c6bd9c5be

    SHA512

    549b6ec1cab433d22d81004fd8449525d17040b7c444390383ad58fca4188667a5891e9bfbf5ebba7d901d09dd829c70df32303e0ff2131e9a8ea1f8d5a60a5e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    c11ef17a22e31a80b17e840961a44db3

    SHA1

    6077fae48781147dfc2e307f2d6d8d739f53e3fa

    SHA256

    402bce3f5df5bb386351bcf601c5c12c35659a66c5f02024b0bb8b154209ba44

    SHA512

    121a054d82ce893aeffaf1def054dcbfc1611cce65a8917d58c7224cc07fcb6c994703b42971e35d1f463722a44d99a88ba7f7b3f3d78ee8a2b410113e228343

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    72e0bd57ae498356eb92cd21ae0357b1

    SHA1

    369751f74cb0c2ba352ab2c4bffd1993f8200939

    SHA256

    1a137ce7dcc2589e86e46b206d812f51508bd8bd23ac738b7697d51a5236ce14

    SHA512

    0b5d911df377a65ed3cf58ae3f29b0cb870300c819e3688c88978f26193589a27024b02a079ff1f4ecf2c46dc9d26b61a119679339754495f07c300d5f022052

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    fab509917cca055d2a0a9b2e806be0eb

    SHA1

    9cc9fe6a4856985b6096f20b3067457e5604fd05

    SHA256

    014b41b898925b21d2ddc0e3f8827b9b775ee0c7850f411d09a0600b0f6298dd

    SHA512

    8501c590639948c5a22288dff9ee577a96a5d989b7eaa4a46e4b952ffebcf761e505079fc9eb6a8f07bf1ab316032b733e9944b385b7b52b3c98e3cf65416d91

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    4c260f2f34df52f474d1b633ab6bf398

    SHA1

    420249866e4a908e98ab4dd124cba8fcb991906b

    SHA256

    08eeeaa06d820fed2c2cd68e14ddbc62a9917af9179c2e61eb3d5b33874cc490

    SHA512

    255262a137e04d006a76f77ccac2019cebd8d2ac5ae22fd934d2ad2457de2691085f4cc075616f76e45eb3da1adda958b661808a52b9a41ab2f3aa34e1f349c2

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    7abe98fdd08bd65a8078b6afb7af4303

    SHA1

    f613bb0f7bd86ff50251a74301fcc3dffc72653e

    SHA256

    88fa0d43a3fb76b4fdddb16bffa4ab5c22b87c372c4ce88d22db9b26129b6c20

    SHA512

    701432d1b2575f3db2f60478584b459fc3c6d5afcbbb23e0e586e371d61f57014046b83b79244b72eb1c1a07db30f2d36593dcaff647ecabb8909a5e5737be23

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    057d8b3da80a8449a98e1d2058152f20

    SHA1

    32ac427e5baec0d9c432237841f35a62537b8ea8

    SHA256

    e2bee429f676d20c8698e6a54a3cbab64de642b08ea5bf7872ebf50a52e3671e

    SHA512

    a4fcbd52ec210c1e4a414a26e7e8e01997bf607d7759ad36d7bf222b0c2202d9f9a61616e3d70e9bff22153c74c63fef75ca36ec14d2c78a1950feee47e5c41e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    307c6dcd9e97ce56482ec13c42b1c74e

    SHA1

    2b5c63733d2d5e627b8a7b4b8eb121478575a60a

    SHA256

    bbd79b559997239ea210347cc7af2e37aaf6a642b4ff6888eeac29b126de496e

    SHA512

    eacacbde9fe32350a735e17ee786d0e44896651cd996107f88cfd3a54cf24538425723d9e980405fa2223815d6dea9aef6dd9c180d3b9e7cb426f79331e66eca

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    032969ab99d41777c5432dd495579adf

    SHA1

    6c578172756271d7edf7aa698e74ea2bd48fce3e

    SHA256

    0b0f50a2ffe0c2d3a2767e357208d512ebe13b467f3d918f27dfb43a7124a346

    SHA512

    2f2488725eada6b199f74bcfac47f60ed06f9acde1999a4a1ddb26b1405c64e780dc236c3ade704ec3d3935658e3ea56010e520aba85c53bac70a951030d7861

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    1477ce50b2a54afd1942c56bcf60bca5

    SHA1

    58743ac8a0e5f46eef0452b93c8a12dcc3830d92

    SHA256

    513883255b1d166bf9c426a1068cd1dfcf618363feb7a473b128dff8e6d6112f

    SHA512

    6bd8b0e3a9faeee78798b647076ee923f0d302dc10986f583a3d0d2687c9db8fc1aa196a48af6cc38c7f88cc2edac7bffcb255e40757cb1242d9de540ac1cce0

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    ba79fd6e8e9d3cbb5012901ab2a6cf95

    SHA1

    72b11be6fc39b1664b2d8b1cfa07bb6b22004e26

    SHA256

    983598549e9f6d1cf4d3447ece7d846de23fa3737f08be2d56efb817a0c40466

    SHA512

    f9ace0c63b37c590e17019e708209997f93850bd5da1655beaf01f5965f4b1b6cb80aa448642b9e4c3065f47d93c48264f33fccb217cbe0691bc6c04fb7bc76e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    884688210a977c6f241870e11e4b9f1f

    SHA1

    a314fa641a76fdfd89ec9d575fe534d38a57d612

    SHA256

    468b2ade36966e03708d0aa3c81c34dc2914a858769f16425e121a6f757453b5

    SHA512

    21fdb39750670f39de007e35f0d44e89e0803bc826ac2e3a4a28387350da9d5806f6abc7f1de281dd5e211307783ca9e1a21dbf2ce82d512033c27f40f5a5d29

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    7a7851580a5d1c1c72192b6131fcda61

    SHA1

    8f63b1fd8fcf2fa94c85840faa76762181e4bf0a

    SHA256

    b007815b68ec4430a594757cb5a7aebd5070b0219005a0ed95df35a5a4cbf365

    SHA512

    2113cf777155c44fcd7fa21dbd0f98331b5ff5279c374b9454d8a80264d3bcd0e97d1855bb2d7ad7144c40e6e2870e3b8c12e0766f12c940b93aa10eaba6f250

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    f69b351f9679860f82a5b388b99db74d

    SHA1

    c4e8cfc20373bf9c1982b8b35f037f52da983efe

    SHA256

    f324578ef9604b42293256ed845310afd0d9a4242bb782abdd1aeb87b0f013de

    SHA512

    4b4bf21ab361297d45e4f679162765690bdc5b2081dab28a5835988ebb1479916d6e54feb57c011f6d5fd04b628a3e0d408d212388b25f436ee6690afd700712

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    7213ac1a46a8f110241b342c8221762c

    SHA1

    a19f241ae8a1f8581a6f5765f336a106b84ca5ce

    SHA256

    7a5f97d2831db251120b94884ce5a0d136cce475d7426b85f497294f5ac37efc

    SHA512

    f995ebca815960ab94db49b1268bca2490d74b8d47bb5f32fcc5f4c49fdaa70375e00cbad5d09bf20e2f73178efca9f7f2b9ffb52b32369f7a9fc71c3a5b5e92

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\K3VL8XEP\plusone[1].js

    Filesize

    63KB

    MD5

    65d165a4d38bfc0c83b38d98e488f063

    SHA1

    1c4ed17c5598a07358f88018a4872aa37ae8bc07

    SHA256

    b1320e0dda0858c87971f7baa0d53063ad2a429d232fd06b0067bda8b9eeb0ec

    SHA512

    abf4c755d88193e7e05398b6f934fc561d8e2adbee7d2170af399e145e54a4a8a93988e4af4e28d6240c0bd1bda7035ae97f67a85a471088820baae8d89f3d41

  • C:\Users\Admin\AppData\Local\Temp\Cab5FBF.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\Tar5FC0.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b