Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    146s
  • max time network
    155s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    09/09/2024, 01:21

General

  • Target

    d56eca3c45e94c3f385f207a830a82ce_JaffaCakes118.html

  • Size

    88KB

  • MD5

    d56eca3c45e94c3f385f207a830a82ce

  • SHA1

    deb359e2ec21fccf2cd873a75dffd4daa895993e

  • SHA256

    7c23fed6b3046f7e52f185b7de6de55bc68a95630c36f8da2921729785740dd5

  • SHA512

    356000e9a53d718f0d2309e48ed9dfac3eb07c4dfa3c70218501294b9fceb961460acea793035de4c49b5e73ba3b94bfa47c9aaa0e89f2a52e89a18fe9fe52eb

  • SSDEEP

    1536:vwgr8VkeO3o26ozmch5fal1Gyy0jsfRcNXICaaS6cgRrGwZBx:PeO3o26obIRy0j+cFICPAwZBx

Malware Config

Signatures

  • SocGholish

    SocGholish is a JavaScript payload that downloads other malware.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 36 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d56eca3c45e94c3f385f207a830a82ce_JaffaCakes118.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2700
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2700 CREDAT:275457 /prefetch:2
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:2616

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    a41ce5904f0bef57c39df5e87de67843

    SHA1

    34ae13a8de0a41b3db88bc9b8d5ddc4eb8bb24d4

    SHA256

    b3e4368de8151bcbd6fc6951b372b5fb0e51874883baee12d5ad1edb103b4134

    SHA512

    fe6205d5d049b5f1249f4aa161c7b4b9879fb0f0199fd1f95c173f7069539409b121b387a40fe64bd70e42de8e5c0d8ab9f097fe5772ec811f8b3c503b5de975

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    17a4c036afdf999ce2fdd871ff260035

    SHA1

    20dcecbcf96c3ceafc4c62b99b70be151528d8ae

    SHA256

    1662d4e2707c7ade60b805773dc186cb1c59b6cde2e5c3b291b318e9244e2276

    SHA512

    e6a298103a0e35e89d71e1861465510217b346488ef69538ed9f38b7b731d79c721eb3942ed12f50e286e0a1daa969c41f75ec6ce783e33bb1146ac98ab59180

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    431a72aafa0eff9f438b7db29736a2c9

    SHA1

    985d4003d48ab0eb17f3c935e8f8f477947164c3

    SHA256

    c51bd4b155a2f479c7ab0c1eaab2f60697d9fa25607f7debca7df4bf0d950297

    SHA512

    e7910bffdc65d6b7f2d23e63c95ef43879640442873fb7b644ac0fa59583ffc804d6ca240568ff65dbc19ec8968b095475ab1f4e9bb15304a679f2e047df423d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    1cd87a68a39bb836f5d8600d1006af12

    SHA1

    e180cf75db0c8f45c850502e2f11850f6ca3f4f5

    SHA256

    a82b373e8576a2e7096cdc820dee76c34b068894bc203d643d87e027625936ca

    SHA512

    98968c9fbb4f080ad63d1e344f7b1b3f69a6bd52979d7958cea74b92175639c7e1e91289ba669d118fe2c0f388bc0298223d4d082bff2a1f7ff8e2683d1fa11f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    fe6acd93ee742fab3146688469155285

    SHA1

    9af48b41d5d76840057ee1ae8065443765833da8

    SHA256

    e2ee71e80339bab9131e7f205a516d336e392972be5098e3ab5b6c4855a6bf09

    SHA512

    09f47f32cb05f00bb70ea73584435349cb04c5da13676ac0459e44526d12459fe998a663ce17645cc59b65207ca4a5dabe902b808c657f689fbf004054c0feda

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    a0c9f3aba3a6ee124e5714cfc180907a

    SHA1

    9206e3031161da0ae66905360d3f8131f6903ab2

    SHA256

    632280425844c58a9fdbe34d1a62a3a0e31f387ebc9aea9fe4946d3f9b2006fb

    SHA512

    f32ee5b1f2b321702c2f11c27abac91e53e2b0226f9966c612d76e4d167f31dfd819d76bd3f45de823663e68b44efe7eb63e038891eeb1cc92be9a30faaae032

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    70abe0b5e3d0360dd892f65339742539

    SHA1

    8d960f2f7a71fdaa46a51bdeeeebf20550ac3d29

    SHA256

    50157e62ea0c8a27265f874284a47c297cb590ddc67d5380c5220fe4dfcd482d

    SHA512

    8859e788429bce6cb833a472992c0efe1364f422101fb7181c2ae5e3b6156665d5311b616c5f43d5f07c381659df5a5c0c2a8ab8b78fe2c93a4add10fa058d80

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    5e3e7c9f50f65eff26294a9a35103546

    SHA1

    0d16164e47d3efd8c3bbbfcab6d990e35019ad7b

    SHA256

    a1b064150953f3e8f9aa0f1f17015ca8b1c4eef82d260ba8d23807db9ec1c933

    SHA512

    2dd114bf7e98418b915414c73e6217b126972763b00fbe589b68c9f7e7ad588815ce6497105e9fb7538298cfee62716e7904097d62938c24b7eac779c7b06ec9

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    6ffc47236c74c73c8f08cbcc5dcd542b

    SHA1

    1629e09a03384cf71135035e839b2e14bff315f3

    SHA256

    99bd3d656f3277540588377fe89835c3849c8772cd289258f7b760d6e0079340

    SHA512

    12393c92b016e4bdcc1862847a2e43044b21049365316fdcaba2db26e4dffba2193b3f690087d6a1fb81579a81a47ac2de74303862d67f44bd282a3f2e1d45fa

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    9260ad1973f4f83578860e0154c9f3e0

    SHA1

    dda9684f56d93ca20f9caf8e8a418aa1482aff9a

    SHA256

    3ce6f45b4b5161d57f2c3b52ddd29132e69c988ea9b19b42c6303af279c18b50

    SHA512

    16b2aec179d46f597817c854516d78cfd10252b35059d3188209961fefe47716368c68d77f1dbf1a61ce6f8a8782f3d511cb66debe0225f10f75a5fb8fbcab55

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    8e58e87ac5339e79524fd29ff5d42894

    SHA1

    8dc8f2a7952ac95d3e08c3ab81c5aefa1a510808

    SHA256

    6543261304027c707458625d6d5ca9fb8c9bf937dcc5f2df41130e9230105424

    SHA512

    87dadb79e8bdbd169b2df757c3b633e08810ea02a9ea7a1c037e0c5483840467023c7e8540cf63701968c080c4cb999b7c83add770032f629c80be5a4fa4c163

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    80100d869d0112426a320f99b68818fc

    SHA1

    aad89e0a49f231a947932894fa3982ad55032c19

    SHA256

    981859effefeca2ee7b2fc488773f69873bc2b8c7184cef76f56f9c250629e76

    SHA512

    6f28ef1f45b0fe5125b38bdbb7b72b65241eb0b5eef5af657c0febceb380ccf37401c7469f923b23dd50b9bbbe84098515883f125fa247278294cc0b25282253

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    7081b31bd26a69bf7714a3f5b7a6a26d

    SHA1

    5357e743a7a7017577b70b940d4db548399d738b

    SHA256

    742a6a3cdd0633f00d0c6755142ceaafa61f2bdbe799eba4984526f18ef1b7a7

    SHA512

    8ee13158a74fcfc51ebd4c5e64eecba5dc5387b0e7497a077f0d6ec67ee02fdb8f8acb48ecfe603c151781ffe57faa039a403ad7547944ff4f63037b61299212

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    735f62468fe9101db1f4627e0774438e

    SHA1

    3a797a8e4548dac106f134eaa7b812a30e033a51

    SHA256

    4e792a3988c771c150eaee09cb62f2084601f3caa9a8fb65be75ba431f9fa45d

    SHA512

    0a76f9ce286a45d7dbbf508be4a9e3327b9634868b7ba2cbf87f205473e5b785329e79257a9e2f1a4d15005dde0c9c4a82f6717856ad28299f8c920e3fd0f7e8

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    a1ba9c3f58f87afc60cbcfca63cb3c62

    SHA1

    e12b64e1c0cde2305a1f157802e03c5a61933adc

    SHA256

    f165afc960289f245a3f073ea979a1ba03b685e9a8908e266bd6a85a41a274aa

    SHA512

    dc44eea6b0e9328e601826cb0f6084923589d29ba6bed412dc57d0745bbe98a214e41a24b103dbdfc35d01accec5528bd59cefcf13a9345cb43e61b1ab8205f1

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    bde2c21120fa6dc68aa9a47047b2e597

    SHA1

    b1c539395665c4c1ff2b4d9799c96284ef39a3e2

    SHA256

    77d655dffd6bf7ffe29889fd1a9c83ca7aad4517353ecfa66f0ad6e92753883b

    SHA512

    074b9ae7a24597c7e556042a8995e704807651e02eadf244564f942f884b64c5ed4fc1ceeffbb87237215be19c996355a1633a45741596298535ab2ba1ebda90

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    cd9b7d1f6f66e9155de6da87d786ff91

    SHA1

    3f3c7ceae9f0986b760966cdc22d7a726f98b7bd

    SHA256

    50346610586b03aeb63548eae3f173ae052ff3c9d8d8831b2d701b88f35cb4b6

    SHA512

    4d699130102afa0e8811d596ed7fd26a40158f59ef20525bfa433c7c794475f857fa78d508ab3b5c35f35105c36fa00831146bd8495e40d0efd7985d34a48b9e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    6acc3ad9e3d0c7a0c4552475a34bcdb9

    SHA1

    b70615ee315ea13ea52863c97a119ede48073b00

    SHA256

    063dad2a0449b4e81630b373306fe0ab1192adc26a4bdfe6a41b4404fb880636

    SHA512

    d28c99fd532bf1da3fd9fbcf4236fb9656bc708efa13699d1cd5a69775ffb10a4d6f2d09cc63c31a13be4fc637dc61436798a5bdb7b5a426fb0a564542ca28ab

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    4121207260fce30ae3aec1330d172b7a

    SHA1

    22be0b05ce6803cbfaf0e6990539b2184f3ffc7d

    SHA256

    e5edc5bd1c810969c7671fb88709350d0ecb392be19242ea1412ee9cc0033ef2

    SHA512

    84bea0d7bc575bf1fcdddf1954acdc2c0e1a0a7e0bee90f3d23ac15e94caac075222721b9f40502e363b4e95b4040f70140dfcf092b5cd095605503f0639b46b

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\56KJ964X\254310735-widget_css_bundle[1].css

    Filesize

    33KB

    MD5

    14f9dd38cdffe59be03908f72ecd230e

    SHA1

    fec01cf03f79c39be9a9e7de6a38021c68c5304f

    SHA256

    1d7b50b44b0b035afe34a18fb604f9776861b8060a3fa6d1e1e59648ee81f1e7

    SHA512

    e5df181552119f8de991e19156b3d6b1098d57ded119b3c6fc256d0bea8bbfe287a55f9d5200b719a7fecb01831cc7cd621b7e52c58f13c8611a2356f19c24c4

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\56KJ964X\jquery-2.1.1[1].js

    Filesize

    241KB

    MD5

    7403060950f4a13be3b3dfde0490ee05

    SHA1

    8d55aabf2b76486cc311fdc553a3613cad46aa3f

    SHA256

    140ff438eaaede046f1ceba27579d16dc980595709391873fa9bf74d7dbe53ac

    SHA512

    ee8d83b5a07a12e0308ceca7f3abf84041d014d0572748ec967e64af79af6f123b6c2335cf5a68b5551cc28042b7828d010870ed54a69c80e9e843a1c4d233cf

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\56KJ964X\jquery-ui.min[1].js

    Filesize

    232KB

    MD5

    e436a692a06f26c45eca6061e44095ea

    SHA1

    f9a30c981cb03c5bfa2ecad82bd2e450e8b9491b

    SHA256

    7846b5904b602bd64bea1eb4557c03b09dabc580b07f18b8d1567d1345f0a040

    SHA512

    1b09a98336cbc0c8ff0f535a457a3db3cd3902e4a724bb2e56563648ed1a36201dd84e63f45dcea80bb6edfe80a17db388379417386dec76341fb9eadbafa88c

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8H7UVK5L\cb=gapi[1].js

    Filesize

    45KB

    MD5

    444a28e91188355c81b0163588b91fb9

    SHA1

    f296530eee77cff7d9c2b8db66a64fbaa91e7e45

    SHA256

    eaa58a83979ba947fb3beb9deedce01085a2a7e7c0f3b533c85153f6c85d1b49

    SHA512

    cc9d29b405170d80c90def9c1afdf9e57138e2e668add7cc635ebd3b2cade4a657c7bbeb9685a181b319d69f664e85fca517bbdc1fb2551a9a2ddec13dfe4aea

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8H7UVK5L\plusone[1].js

    Filesize

    63KB

    MD5

    65d165a4d38bfc0c83b38d98e488f063

    SHA1

    1c4ed17c5598a07358f88018a4872aa37ae8bc07

    SHA256

    b1320e0dda0858c87971f7baa0d53063ad2a429d232fd06b0067bda8b9eeb0ec

    SHA512

    abf4c755d88193e7e05398b6f934fc561d8e2adbee7d2170af399e145e54a4a8a93988e4af4e28d6240c0bd1bda7035ae97f67a85a471088820baae8d89f3d41

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8H7UVK5L\relatedimg[1].htm

    Filesize

    114B

    MD5

    e89f75f918dbdcee28604d4e09dd71d7

    SHA1

    f9d9055e9878723a12063b47d4a1a5f58c3eb1e9

    SHA256

    6dc9c7fc93bb488bb0520a6c780a8d3c0fb5486a4711aca49b4c53fac7393023

    SHA512

    8df0ab2e3679b64a6174deff4259ae5680f88e3ae307e0ea2dfff88ec4ba14f3477c9fe3a5aa5da3a8e857601170a5108ed75f6d6975958ac7a314e4a336aed0

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YTZJPBOG\cb=gapi[1].js

    Filesize

    163KB

    MD5

    8d081b6e9d6934eb63adde3355f9a8b3

    SHA1

    193e6e9e3feb35f854e201f99e1c9de2a2435554

    SHA256

    4d357846b85b33441b4ba2409f7affa2212ae546890a8b42f8a8baee386a54b5

    SHA512

    4eaea391db80a0ecb0bd9ba7d94130d546e6e086f6dcf99e6849854b222b82052c54356a87b43b284ab36b3da46c2fed42ce5d798d4f86d234f592bc75c55ae5

  • C:\Users\Admin\AppData\Local\Temp\Cab846E.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\TarB3CA.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b