Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
24/11/2024, 10:40
Static task
static1
Behavioral task
behavioral1
Sample
9424c5ff7f6b9db85936051bbc12a676_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
9424c5ff7f6b9db85936051bbc12a676_JaffaCakes118.html
Resource
win10v2004-20241007-en
General
-
Target
9424c5ff7f6b9db85936051bbc12a676_JaffaCakes118.html
-
Size
129KB
-
MD5
9424c5ff7f6b9db85936051bbc12a676
-
SHA1
7962619837e99cc405733f6a6281f6d1789d0852
-
SHA256
0f024507e712878ea1284d08720f2da9f04c872f2f0dde3dffd7afa12bda25f6
-
SHA512
f87bcd65c608e1467ec18fb620411f8a6a9d723a34402c39d3ecbe632a4aa9eecd99fe4810b139239f057c1909291564337261ab9a95c475205e200a36f7d2ee
-
SSDEEP
3072:SUUCWDxYxQ2PDxYxC2T/Z1sxoEpr2C7SeohzSNE7jfCqez8/3lu:SUU1DxYxQ2PDxYxC2T/ZIAS
Malware Config
Signatures
-
SocGholish
SocGholish is a JavaScript payload that downloads other malware.
-
Socgholish family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000078a0cc6b0b830b4fbbc12dd3fac6f54200000000020000000000106600000001000020000000d3b9d67e3dc840c7b729374d8aeb9d56b0a684e2b164ea48411dee0f90302875000000000e800000000200002000000029c7a95641bcbe9b216ce0787f66eaeb3d9b72f8fb73c6a5083e543398c5a7ba20000000e3020fe63839bc22ad4791d555d36821fc3c4d8c1a1edcf10ca08ef5f5045575400000002f7499c5217b1857bb5c05d04833f45c352dd129a83feb994ead452f527e5a8bc636eac34e50880609b5b729cdd2cb052904d047c3a6a360320b9cc58c707597 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{87C63451-AA50-11EF-B5A6-7A9F8CACAEA3} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 006830715d3edb01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "438606700" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000078a0cc6b0b830b4fbbc12dd3fac6f54200000000020000000000106600000001000020000000c9c2c308a4a3b4d13c948d7ebac8deff3f69fbfd8c658d4e6025af43189fc5e2000000000e8000000002000020000000f777b76f585550c30b6390ac7dafae79e9b8db09618f85d047bd3fa2d76c0ae190000000efda621b9f55d34236d8ff195d97e991902d4cb3bd6ac74d4030d2ad683a71bc2afcdbb0d964cff29ef92a7e4dffb2dd5ab85e962f9efb31ab6812df4a4d2472502ad15fe649eac93a7513239ad10099248124b554939428a9612dfcb22a919bda3d963f2ec2512ebd36880d5c61f3424e01f270c3baedc5e52e73b0255d73d92554b46af2e85d66daefb7afde5fc14b40000000560a2ee5f4b755aa8057b8975d58eb81a835620b3abdeb718ed1d426070cefe877e93762ebb635d57f5473fbde487a9259d7fd2a99ddb0564a8f415e39f293da iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2348 IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2112 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2112 iexplore.exe 2112 iexplore.exe 2348 IEXPLORE.EXE 2348 IEXPLORE.EXE 2348 IEXPLORE.EXE 2348 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2112 wrote to memory of 2348 2112 iexplore.exe 30 PID 2112 wrote to memory of 2348 2112 iexplore.exe 30 PID 2112 wrote to memory of 2348 2112 iexplore.exe 30 PID 2112 wrote to memory of 2348 2112 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\9424c5ff7f6b9db85936051bbc12a676_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2112 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2348
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
854B
MD5e935bc5762068caf3e24a2683b1b8a88
SHA182b70eb774c0756837fe8d7acbfeec05ecbf5463
SHA256a8accfcfeb51bd73df23b91f4d89ff1a9eb7438ef5b12e8afda1a6ff1769e89d
SHA512bed4f6f5357b37662623f1f8afed1a3ebf3810630b2206a0292052a2e754af9dcfe34ee15c289e3d797a8f33330e47c14cbefbc702f74028557ace29bf855f9e
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B3513D73A177A2707D910183759B389B_C3CF9847C2CA003AA270AE473C534F74
Filesize472B
MD54b50dc8421655700b94f6706c096042d
SHA18605d7edf403fcfdaabf59ba50ddfa81ceef4dc0
SHA256d72a50bdc7c73d30adc5af35cbd043a7acc305cb27ab83389cd9f75387c079fb
SHA512e9b3271453a4adf9930001aaf691b35a215397468c62fb59b65c8265d2af1c34556ffdd431505924b4f0f9db05715c3b9d9e1b511181dec98d4033c8602906f7
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD540c0e66ec57ecf1195efd26ec70827a5
SHA1a3c28957259aa516c76f44c604bf75305734898b
SHA256a6d89f32e945abee003f14d1242b5bad0d3b306c3b98becdfa57f374cebc49ae
SHA5121a2df04e5215956228d426763bbdfa84f2dff877d0cbc78a3209747467e6bc3cafe70cefb7951c6ce2b45b3ac85aa4071922c492ff7d538c1e5caafa95b9772b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD570342deaff7e7570387290faf2d42fcd
SHA14ac054066937b16379ebcc1073f32d1a5ef08fad
SHA2563048d76e946866549babb4a90403e9dfb47e87267732fecd32a709793197341c
SHA512fb149587f4f5112310a45c39e01fd7c4338ab13d03b79aaec8e5fec3c4070429f5333329f650b9ef629b99ebd6fd28058d1d387892bf9eb780a78077c31c06a9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD594a5acd06a83e173331433236e33209c
SHA11bcee0a7ca6854a65c4e90895b5ca81402d5e3e3
SHA2568dd31d2e6b4da63ac7b88941a01894813115ba0395c327d4343146dc5216bc39
SHA5120c84cc842fb744ad5b8d7509a00d4321f1755521b2e590c591789e933c559bcb9fbf3217b5b15316a030265bda4b73326674076efe8a50906032fe3620fa185a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54c3ef1d84fe0c60ddb88675bcfaee5a0
SHA1e5728bfba22f0388bdf44a56987640f2784890c4
SHA256756a50c723442463ddc07e5ce140b14a7a9e5d10c872cc5812b9c0a5ff4af2d7
SHA512664d9bb346385eefb415c318121fcef33c406882a88c8200dc83433fb6bd3c0aebe48bdc2c6fb8db131d37af0ad8e139d6ab300d355bdc9945e1063e4d483701
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5839bb51b5151d22d6c19d987c52b8cac
SHA12c213eca942fafd92b72ad55f93d3ca16f39352f
SHA2562b0e4ccbf0659bdbbbe41ac3d420a8420d3dbea015f2deaea34632b9130e2048
SHA5129d30f436be4f6fb07c626b157f87de43c234df692716c9abc252059d88d350bae188193795cd0cf9f899845394a5a534cbccc3e6fc9c811f3066fc7f170acb3f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59215cfcefe9ef23d07c53c20ce85f927
SHA1b42f4b15c8540333a79ecd6bcd0ca72d3f3baa88
SHA256466e56ba2a0b26f14614baca8307e2375989aca3571d7e709e9597c341d39ab4
SHA51249c7f9e2b425d09feb007a39968f39b6f17b7eec5c506a68d9d3b130937cff884070e524f0365966a48457bdd9dcfe7f3ab6852807b799a5f4c46ffe2403c0f7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56c9e0a484112255858e64e8a2d280d06
SHA122e6e4e4edacb690fd2098439de6441ea838379e
SHA25642d708523f9c6e9354ed105b5181ad2d8c134f26755af29868345c14a3008a7a
SHA5129f35c97a31e1a3759b26870cbb5c6d34f6ec6276d880edd4e51db8acbe50da2e14cce23e12c54f3c2268fb4b785b280264fda8b9a3a1d0321cd04a1081209852
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dd46dd31ba9cdcad12461ff420036dc8
SHA119b973d14d4197f5b3fe55de26403b097300bdb2
SHA2563412cf86a981615fcc5c210fd0c63220f98ccaf9a9d09b901c431138c66930c4
SHA51292397450fbb2b62f57bef7750c5271aaf618c11bfc09b958738484eca87719cfac315c388e6880a498886f851a4c82bbb1c0d4053a0d8b3b3343c19ff8ab8634
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58cc5ace9b8f4c89f3435a158326189b1
SHA1806044d821a90713d7153a49be79bf5de2166fde
SHA2561aa57b215f11fed4eebf5ab5fd7b10690f93ac3d5c7987b871fdc8993a1f307d
SHA51297ae8e45a95b4f496d815d3300c7248e7268ddd620e843b5bf50879b9697586a851ae5721d63cd3dae8556e28e604abb0ba6553a47e2f2ffd3e3aa2488718d2b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51bec14b81d83a13bcdc0ed4a3b8af815
SHA1f8210d362ee37c0a7776cb4ef2b1dcd1f2a11396
SHA2567b509ece1c2cb1cd19eaba683a8b9592474bd9810fb76d6140c43191eabb27f3
SHA5128105f433b26f996e79464ac5e331aef47898fd057cbe330198635d940f776e767af9950680518fc18bac26cebe1f754d35cb539019eab153d56dcedebbcf9811
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57a6802dc095f34df60c1fc3ca65fcb33
SHA176669bdf1229144ab708c4c0494d38439e12ae0e
SHA25679644700e3b379e0f84bf4750753be3cbd5959e9cb4643d0f527ed0cb93c8d45
SHA512706fc53e5de269374d8a2f3c4d1dcdc59dcda38493b550c8f63aaedc2b0e26d38a63e7d80dca53e452ba207423f1e1a155e9b7ef0e07448c767c7125bc569424
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD5af9546ab7d05ac47b3db98ddfcdf6ecf
SHA126ae583203179c186bfcb6360885d0e1ed92f3aa
SHA256fab57169f95fcf7321edaca2346b25ff9a577d62fc173a5825811e2739c516c9
SHA5121d46696109d1346bce506140dbff3e29723872356acc410c65fcd4b782c448821ccb671734d6e1b61e12b2201d4d8e09adcf898d914513d8614890ca3de593a0
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b