Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
25/11/2024, 03:14
Static task
static1
Behavioral task
behavioral1
Sample
98dfa0186c8b62625e42e046a955ab80_JaffaCakes118.html
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
98dfa0186c8b62625e42e046a955ab80_JaffaCakes118.html
Resource
win10v2004-20241007-en
General
-
Target
98dfa0186c8b62625e42e046a955ab80_JaffaCakes118.html
-
Size
88KB
-
MD5
98dfa0186c8b62625e42e046a955ab80
-
SHA1
b8a7f482fa08b45c4e86fc90330b3e676b033cf8
-
SHA256
73a425e4537e71a2eed7f7c2e29cc067a977e11417bef6e7d8a5fbd99c10ebd5
-
SHA512
cd7051c245e1ffd071ffe49793200f136f18ea7a4078403676b8aa09d65824edcf8c26e551ae7500ebdce7af22e26fa52067e21c70eb4082877c3f07053639f5
-
SSDEEP
384:S0p9uEbkOTxje3hYzcYlbzKTM72gxvlB1OiYX77dcfvFMBROiYXcglBhvLXX/HB9:S0p9u+T1yzw23Yn6r441pEjT0KP14b+t
Malware Config
Signatures
-
SocGholish
SocGholish is a JavaScript payload that downloads other malware.
-
Socgholish family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "438666333" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5EA29DD1-AADB-11EF-BD8C-6252F262FB8A} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2904 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2904 iexplore.exe 2904 iexplore.exe 2832 IEXPLORE.EXE 2832 IEXPLORE.EXE 2832 IEXPLORE.EXE 2832 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2904 wrote to memory of 2832 2904 iexplore.exe 30 PID 2904 wrote to memory of 2832 2904 iexplore.exe 30 PID 2904 wrote to memory of 2832 2904 iexplore.exe 30 PID 2904 wrote to memory of 2832 2904 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\98dfa0186c8b62625e42e046a955ab80_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2904 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2832
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD516b8db67e48f2759ee439a06ef666abe
SHA1796ddb3375bde86c224565b6c5562f34aa799984
SHA256ba111cadb99ee4582013e492e5f22e6dc1ab4db39fadd961f08e1c0f69d18bfe
SHA5125ca0fc38ef1e0b403820900845ccc5e1796ec51055de623b6136c10af7c01a67bb8e5706f0eaae48cf9cea3d889fe3b27e291dbe7797bd69d397dc1de0d2594f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5aa98cd77ccdcd26d2756285319fa7ecb
SHA1769b77622aaeafd450d93fdfaa7f55ab31636f35
SHA256529e377de2ccd653028d0daf34215f4e92433a7b0af8e8225a72e6fe4693b029
SHA512dc4d3cf92cde423e4f6672c878d23fc585dfb97500696ae84aa61a282555513e1e39a82ac76429a5d6c4ab928d344fb2901225a0d03f165afb1d7e6dd7ab3682
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5583a9927d22accd4b271d0426bf77947
SHA16a83e1108d0afb3618152c87f226714332459ee2
SHA2567c492b34bf6ed286cfddb4637fa28d599949c8d7d4931010213fccfca82c7d49
SHA512cfb65e9e5841591cdad3c7c9c2cfab1c60c3fa1eb0cd0ef1227d98984dc2590a6c1bdb18af41df4382b314a93b06955201f1f16c66068c56c3fa98b5dc0e0836
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5631ce2a9a3ff9fde86b6da8b75423479
SHA1ac9fc8a6a4daa7a7550d74ef2f3676434d145656
SHA2561428babcdaa280942ed6041e43b3527f3564bfe045ed081339bce55e3c5c07f9
SHA512aaffe8520820cf3ecff2369d2be2951104eee54d18927be9da9dd3d440b5c5ccb4eae3a09fcbf8c2fe9eae439be5e960e6337e63f2a3a7b414b47231fe41668f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5470853c9eaee68e5996357c02ba32bbf
SHA1b30ef97e181a376603065fa8831d9a3b571a08e0
SHA2560bf8cdd852091f6b561678c79eb1a557db4773dec87c7db4a834af07bcc2c0e6
SHA512692016ba4cf53fb8949479cf71c48be3c7cfa98ba925eb62902ff7981e8eaa8a48dfe3edea23c9ec77d5ecb6424d91100ecde8dab524b5c6cc7efc2bc97a2d08
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD527a134126f9794f620911697b744b960
SHA12608c608457f535ad427f3e9b8ed581fae0b2551
SHA2561d1f0027734fafa0bf11a292f2eb26510a407ffbb11f57022a9cfe2df169c38b
SHA51265b65a4d44c31e2c24c5c47e3fbdb4ee6651e908361e76bc3ec03f1b34aff35b7b07b47c0b9a8054bb1209ac428f8e53ece3cd281056a508d210c14b7c289981
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e2448f4da49d958142670747523f98e1
SHA10c433ab1c474a08a52fab1ac0f0735098a102859
SHA2568b2ae52a10a02f5ad6cc73b59d12891eb2c56043dac17dd9851316422171b9b2
SHA5129af748d483fbc0a1a9f5961c9dafa0eec163ce337de0b4e72261d8f0c8e2f6c6eed9e42383a0ff07d912f68ba8446620539051931b64044214f677801a37dc4e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD552dfde228fa17ec1152445501575ef7e
SHA1e7c792cce26369f92dd9b84f78be1afe50c42738
SHA256acd2969c18e571687fca4d7dea2cfeafc42503d75b2a6cb7d97425aac67df911
SHA512a314ad936a25661236f781e48acd1f01f47cffa786d44d8a6198e85948ba34208efdb30155ac51478f1845588d35eafc0092671bb549b5ad15f269d80dc52bdb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5283aa282f8d132fc8778b59e69b899bd
SHA13fe0614abae7783b5b547d449beec3c5da557ff1
SHA25604a1cb2dd22b561f530669e6bc7cf860fe37fcefcf034d9d0b16e7659651389c
SHA512f96981061f75a7f1980eab468efb5bf99a54dce38b41d2fd3e2e03eb640152950fb6de86fa8275e39ffdb0602e18db88cf7bf9085b69444073331426e3c4228d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c9cd3d2bb882507491c5b905f1edf0ad
SHA1f9ff5375a51c831d452bd23c3b051b35d0b95dd8
SHA25696ec77909577151f44f504369083056f412dbcd6d6cdb857f96b931f4bccd7cb
SHA5120ff606456fe7c1463da79d237ac9339e1e35be5f097d76debb207b402ac8af5d39633da92217bd10e62cf354f3a49f333a853811d1d241824b1ba2026e6cb9b8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e60c2f62a927e26aac3b5f4537cd9ed0
SHA100037af81659df94e8400daa9936b4402e132aed
SHA256e0452b2bc61702673abfe27a30d7ffc327067766ae8eda617f3577668d7a01df
SHA512914c28f1d965e0c57ed822328bd78c3242232678c760c075e09ea3e51361b522d339033efa8d658e9008b5fc6e0db63d1bc4839f9d43deba2cd38901618d2251
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD515558a6feebce1f9db1e920823ac63c5
SHA1172ad625dc98e601c59f7a9835c229a95f87d462
SHA2566beaac4e2096b06b5e01ccecd831c2061a70464323f13a98c814aec3cc0c3ab2
SHA512f6227b87765acbde244a21155a11095bb77512756b47227f8d15c018807b82081af0c68c8749a5e2ae6e087828a2572691e59e9c0335b55501c79a0238567880
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5988323ea0833c0f3fedf208f675d9067
SHA11709407de2c192f784fe8a2c05e656cf14037253
SHA256ed939b8c43e6da3a0217cf95edb51dd12d5303a3d090a058c2fe9a3efa7e5aad
SHA5123b43ee5c99cb62d57ba885f218e595ccb17d6c3aecc6a3edb68f2717bdb81e19e7ff000bf02281085219e9657569cb19bc52f9c74650d2a6f8bdf91755b3970f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD556686e26e28d9d0aed9d6a7b2a47fe17
SHA144c16f3bb706362159299d6225ecb8a5114be6d6
SHA25646f1b7540c7a3cfb831b7e3c216fdbe55021d3228ee68451524bc5063afc74e5
SHA512c85c8bfbff219e5183c3af237de2b39a0488ffb45ad4d6a4b257dcf908c6243ab3d8ca06400e571708afba4aad81b2fdc1a2b3140f49a87cb50debb2f0167848
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ffb772fc1103ec235362c0d2d35ba230
SHA14119f213bcd91d51c04c8ab4ca50ca5cf2c8a2e8
SHA256f9d7c3ae5ec1ae4e5b77ae332612fe15bbe0da0cbe7d3296f61464c28cda1be4
SHA5128ff4ca99614681da95fade8340c98a44006888fb553db785fc24050415db5fcf0c8b85764f94a6dad07968e2fe52498f14b35dec554d413137cab34b30b5e19e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dd309cabf3b1a0b260b4fd5f1892e923
SHA1825d1c06201dbcaf1144b83cd44eb8bf91edb696
SHA2563c72485c201d0abd690e620b2bed9e4adb31d5a66370f0999338739fc6df9b9b
SHA5129db4b500238316a086febaed951bcabafb04b88a00d1338d73be32d8f7480a035177fdde12844514bc290fb6dead0f7a13d2ac35b43e32d92b654e3c3f58ffd2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cec0a60b84079bdb67b5dfb07b7c73c5
SHA10c0bc38e578691a144b12d339d744fd79646e40c
SHA2566557e2286b05d79737dce615296fc8dafe553958ec41ab3ca35d5ff88966ff85
SHA5127f28564b88f1e0d1454b2748ba16d8d8fed67e75f4ffdb82c615d94bf600f0dd411bcbf0f84dc915dc3af12d55111ca49b60797fccb6ae10b62a89bbfc76064e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58c80128b9899eb8a34fffc05acdf38c7
SHA18cb9e53d9b9d092be89cf588433970bc1127694e
SHA25638c60640a4376754dd8fd77a85910ef4b2519dfee8dc9cf2cfba07a65c7a31fb
SHA51207abfc6b3dc724ec10d409f2c0966844469297cb4fe84b6a3e9e6404360088bc3622d35d53ed082e81624547fd5b534653867a65e8e5eb9228272c40ef3decd8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5957b06db086384133dded65399855ffc
SHA152941086bbc97921eb63f690bdda49f60b61db8d
SHA256e33c8ad0587a96281da743dad43008d3c97e0e3b77affb5a0493557b0e2a1743
SHA512e763642ef4f18e904855f530e83ea336b1da197b0dce8463466261828e71a0923493c8d598e4d674b8ad2e7478546a98b1d4fd051f490f783c9c7efef6a66b22
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD579fd400672c38b9a11edb0fa615c6a4f
SHA12ca24c73bad5eea21800e62036d9194da4e599c6
SHA2562f8da76f1dd415c70d981cdc1415ee0f980a9c4e6e33e6d475bb9ef6eb915ee4
SHA5123d2d4ff72c91d4a95a12895ecee10240c0fd83fbab0aaabbcd234faef94b1daadb34b516858b70044298e7a4093673dbc19a69fde81ca54bd4ce6aaa3b89dc6b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD5d2c9a2038dade6a789ce0a13931cc156
SHA199902626dbb175ce1c55f0170ec311dec34a3486
SHA2567cf6226a94c0a3c03f9b42d74d850ca5ea3ae4fb4d0a729e78a885113bc9ae28
SHA512a62d7f045a908f413cd23b17f18f69c2d6a48f258696b99ae636a6ebca3621b78727bf58753bab2bd9e67cf770290e26b5ab28a4365528526cacec646def83aa
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b