Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    142s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    26/11/2024, 07:15

General

  • Target

    a08a8bfe30fa399675805f08d1cf35a9_JaffaCakes118.html

  • Size

    209KB

  • MD5

    a08a8bfe30fa399675805f08d1cf35a9

  • SHA1

    0146aa5d184d77f476cdacd298604c8b984122d9

  • SHA256

    ffef171835d3d2057f9484f3fe21726c645dd44f607a31701634dc9fad58d736

  • SHA512

    e2e9d89bfd31ed80ed8eb173b2458176210f01dc5fb699669fb9673f108e1def6b875af67853de2f06aff7c391bb69d3e7a3f60ffd46b77c75238e92cc334292

  • SSDEEP

    3072:L6JXanmdWNlBe526Bdr4ACFZx1irKTTJtDSNyJmoTmVrhl4D:yXanztvD/

Malware Config

Signatures

  • SocGholish

    SocGholish is a JavaScript payload that downloads other malware.

  • Socgholish family
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 36 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a08a8bfe30fa399675805f08d1cf35a9_JaffaCakes118.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:564
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:564 CREDAT:275457 /prefetch:2
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      PID:2824

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

    Filesize

    914B

    MD5

    e4a68ac854ac5242460afd72481b2a44

    SHA1

    df3c24f9bfd666761b268073fe06d1cc8d4f82a4

    SHA256

    cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

    SHA512

    5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

    Filesize

    1KB

    MD5

    a266bb7dcc38a562631361bbf61dd11b

    SHA1

    3b1efd3a66ea28b16697394703a72ca340a05bd5

    SHA256

    df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

    SHA512

    0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

    Filesize

    252B

    MD5

    400dfab1ea718afb95607f3091c087df

    SHA1

    815c8c87b2df67b8fc02f29f1a4fdf849be80c4c

    SHA256

    68b10e32498676a4687b374dbf4c3491d01aa60e9933ad936144d5856ef81a55

    SHA512

    1eec01e45bd31e38f70c1b48c9a397671e6ba81199e1d4893db630c4a1f2a1df13f5006774aed904767fce439d95cdd410912661f98a4a430fa233cfcbd9e19f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    c7544ff02cc2217750b14ce76cd9ff55

    SHA1

    caa4b286111f491a133c9d074ef8398c317d39d1

    SHA256

    603f4bb7cdf6350aef1fa8022dcc147a0f1783c9ea110fc61b57b02ea4c513e2

    SHA512

    452af7efac6d527c515fc5b045cd6fb6a54b8a91ea83837a257b39661ee5748bc66102302612de696c7a363201311d6540d5639a4edf1070dfa029bd5206701b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    798c4d6d3a2b28a47e44a4f032afa12a

    SHA1

    425bb520fb78fd9a1175056e8484cbbe3f35791a

    SHA256

    dddd07669fb9550aebf6673667b783f0d09eb3574febaafd72fc2c4e1449e525

    SHA512

    d6f89e152c415f5811b9d3e41e39979cd74140d875c8068b0964db45e8a81ee1dcc6b52b50d7c16136e9444800aeb399f2249845020e6423730853418552d030

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    7e72f7ee85901b6dda6af1b42e3ea681

    SHA1

    0fa7d3eacae4f18910adfa5994a30b75a4c8e528

    SHA256

    21ab8f907ef79be62b5edeea5a5e835e31af3ace4a6caf59859f11a1fcdf9b28

    SHA512

    67fadad9412ad41af9fea540586c8bee5b617779ca4bf2ec39921f26ce73f8b4aa93e24e62053f5798f2957e56cb99c98c4fe4712ba970c26453c0fc515d4201

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    2711d11c4414ebe436d64bdb1ff94573

    SHA1

    391a63eeda812537e31f398e2282e89d4ad930ce

    SHA256

    e98bb65d90b4ab5e054a48e98b4208a6e628e9ef92d3945cc578d42cb742b52c

    SHA512

    2eaf3e785ad661aa6bcbd2deef88fe239a7147a819f2cfc74a7558524b240d5307a7219b6947e234e90ec1357bec973ca39327192c5c18ca1fbd44eec515797c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    31ec1e4c01894d8fb57bddd224f80699

    SHA1

    0fbbe4a2cd89f954e95c2f95f60a1c9db18a6164

    SHA256

    41e40ddeb9457f18a0c046b7a4d66a17f2ad308307d06f895fac39d54e4b1aa8

    SHA512

    471bca55778931ea42aaa507190ae407f7225892f87d13bb28637152eb8a35acfb2552870036ede1521f43eae1395d291d4137c672e2a896efdf79df2adcaef9

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    8182a54e18224091ca63dd29de21dc30

    SHA1

    3023926c7cd8945fd52bb55d4af33b4534f6c29d

    SHA256

    7be47901996fe807dfc33376d0189adfea0703bf80c6e93e4f7f6203f2772e7e

    SHA512

    de612b1cd8546874b2380c7eb7be869d2233b96c155289f4910392736d53e4594925a805f1cab0234fcbdad764cac116f2edc78b876e496a4660ae153b015c9e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    8ed255d21d8e87743aa026dc4b05a0ec

    SHA1

    265850b456bdb22225f3bac75bb37ee99360074f

    SHA256

    cfe589cd8656df22346840f9808ff2836426f5305361dbc16704afcdebbc8544

    SHA512

    e03ab8bb884761616cd766f1f5724fc717400b6545412f5c00c378bfbadf108271e2a1a113ec458074745a296f81a34c34ffca238d6eb34b7a831abe008d6055

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    2c3aad6b9f6f0e69800dc51a3d0e76c9

    SHA1

    7027bf77b1a002213429940ed9142b4dcae9485e

    SHA256

    98182cbea21c90cbc6fc3d904794e2cc362f1a05fe5983c91e2cd5e1f4fe43e2

    SHA512

    cf25ab6e09f8c4e7160ca6cb544bee1a1a6ccd42c0ee3f9c58fcc636a62496c8ce1c1f2372f659f8fa0ff0fceab0e23d6eda905c4464a6aa16ecc44bb21e2b9b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    6d045a1e5d6cf8af18b0d5c9bfadbffb

    SHA1

    696454ea340f996393ee5d58c0517c17315fb703

    SHA256

    2ebb1d26cc4d46658098697ee7f4e43fd20a50f05605d38cb92bbbc5cd236692

    SHA512

    90420ff3b9a13f8293e040362d9670af4e312402f1fd5532fa73e5467e9aa258a37aaea7e31de0cb2a233bb275d8d0b66c01d9917cb6ae0cdcfa582dc9cb338f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    8dea9a4094e357b1674cc35a782fe49c

    SHA1

    842b324b67aebcb636645e6e7733194cbebefdb3

    SHA256

    b87c486981fd3407f0f5cf08db1a08f6b060aba125cece026004e8ecd63f6ff1

    SHA512

    07b47fef1c4711ba69739347c4b5c1778c9c0b69b29872314d0443e884796985c0f358dd2e2ad230016c60ae7e249d548289ed1919112b0edba56a1f2a3d1e07

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    9e45fc9a7cb52c83e1e2214e6fddb7a5

    SHA1

    76b4b23132ce80423312a6310ad65811996174ef

    SHA256

    ceca4e80a9a649927d0d1488c0d75f3e14ff44d9a33d227b2fc7cb213d1d8b44

    SHA512

    effab29f46d16457ce9d0a28bc81347f7675f73da4a0758334ce788d9d9d776dc2b82c3a0d76bcce91bc330a718a68058b0851f7f7837a60aa35450303bcb92e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    01480df448426254449e93974e1aa74b

    SHA1

    530ac4ab5cdf501ba6c2e31398498d4ad86ba16f

    SHA256

    26382caee93e15e77a1baf946c2d10d3236940bb08b30aca8e3acd3479a9d692

    SHA512

    d9e55894effd07f063f63600c6d33c77624803623fe568fe0db546fddd05feb180453ea4fde41bfdd86d08a568f224539ecd23790f28bf21deba76042e457b71

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    8d6528f6ba15a37c6ce724a475115ab8

    SHA1

    d82c337efd63bf6270de8036e4add092f043e22e

    SHA256

    8e1e1ba2b3c26b714c490d5249557f93a20f87ddda235ee164f867c0daccddc9

    SHA512

    994a24cb85aa7525cf198d12bf56c09d3eee55f141f633bf7e9c7dfd0c3950d8e04e7724ab3e820240ae803cd693db72b89362f8c8e7a224c66c0ab0fddf8e71

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    4b8d71980dc844c480223fe663ce9a1d

    SHA1

    443c5568a5ce72395c8ce54fe48c99b7f90aeb1c

    SHA256

    44bfa64f84d2379dd6cc61c449aa182a79e0b5b96b772a373a1fdef287cae4b4

    SHA512

    43c6c54744e22856db4c06b83818832747a60b7bf93ab8826bc6052604df60b52b58e3bbdd0ab47242f0c2492a86fd6a508ad2c43d7a3d09a62b978a0e07a3cd

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    5a093d55aef6dfb87e5abd7f0088efce

    SHA1

    6a4dc9d3e673ecfe38c72ae27510acfa2b94d7b9

    SHA256

    29d92e8d0a5114c70b63aa1bef29e7fe05fa69318db0f9ac0d88c875f1ce1f91

    SHA512

    5c8088c30af66537453c64086773ae3abe873268b78f5d895d6393ad656192ff8331b3f5e7f85b0624bcfd955d03aaf3355c30e93bcc77c64ff0349c2a4a56bd

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    33a13933d4fddfd4aa1621778d8b2841

    SHA1

    4d6ee7a0ffd61c0b48e90870dd76b74eb7ec6045

    SHA256

    aa642385f2686e6bcfc38af1f78f3cd6e793f4b90646709f7f1540d37d65f480

    SHA512

    c8e728f3e737ea7a9fbb9bf123065d823ba4435697d19d25d392e6162d472c0cd0145327412f6b39343f47085ea2e0b718f7edb2e5607779f61b5edaf62d763f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    5e4373ffa01df1e0fb06e03ba80e12d4

    SHA1

    3af0f618148603746df2138de18edbefc3663e2d

    SHA256

    3ad8835df11162819ffb54916becfa3e2f0b11f96ca60c2589eda83e7214ffa3

    SHA512

    a44ba407015f04fce9036777cd1c96d87cc52dee36b32134c9e1bda4640639d92753b229d78b6e442b39fcb2cd0a5ae76725b1652348d019465101d06e532236

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    d51052e9418316f496d8180c2dd71389

    SHA1

    38e63bb9ee97409c51873d0e73f22b2de9297ea1

    SHA256

    fa6bb83ef7bc693c69fa0de8f254853e30e2871230083e511d117d041d7937ed

    SHA512

    8dfb9f89f8b56d9ec42406ef52e5214487ba77c8ef3345ed2e9a8338979808aecbdc5b0509d801214b77955d026d1178c2c19a2e2176b6361e4c9be5f6312b84

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    c80e1ba14481010b493d3c6f0e1a8be0

    SHA1

    7133a98473a954e8d3e120d5776445c3684145de

    SHA256

    ea10145ac908a7ab079e6110abf3c10c4330e7277e498407138ff321394bba77

    SHA512

    893eae3eeb38d3f64953706aa80920c687381465336aadf2384c8a42666f8f21e19c7ca9d3dc09883f17577aea8af284e33688030b909e77dd0d458e0fcb4492

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    15821be47d30abaf4b505c3508b054f7

    SHA1

    009da18aecc32abb440ea520cfb8821061964edd

    SHA256

    1dc5de4534957e7b80a1158f0d1b523d70a632099f15219fa2968b39f1fa8144

    SHA512

    a7d49c185089b7ea46fc6355bc9cadfc013910cadf438f585a9033035f88988641080da2dbbae848380e15d7660d5445103b3eff28d1124fbace5a3248bb0392

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    1e1a3a5bee9c10017b5136ba411c3243

    SHA1

    58e44d9da1470a0d363a8435655f9c916357973b

    SHA256

    e927caf1ce93ede4be55458f29f14e4b88a3e9f45326f931e563c9b436eba72f

    SHA512

    af9d5278474be2caedb24df274a3b71416515ac1e95163df3fb4af1916202a32388a5ac417cea94864ae2061eac41bcf3fcd85720bd447fee066c8a9d2878f26

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    a7996305643745606ff61a815cce3700

    SHA1

    6061fd6679730edff47453c7001d88284e52e806

    SHA256

    7ba3efe465c62d95cc1d247053c20fb8f04f92e440997de06a2f82691d0c17f8

    SHA512

    0f11daf74116b1a7a9e888d8b3de9728fbf6eba322e18840cc736811af8610e082644dd3fd495fe3135024a6f427949002eae404e4b41ea28346fab9aa364be3

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

    Filesize

    242B

    MD5

    cbd41f3fee0a17cc1f8ade42ecd96933

    SHA1

    0d1df910ed9727c16600ead318680bd3b6025218

    SHA256

    f800e4defc33755c5a40a002a8130c5d6ac6177875ee38b18d5606f6c46200bd

    SHA512

    2e397664c073783f86873607cf1046e2451cca816587e66102a2968945a7f13c9426fc289e573f3c978ab6c96ce282ed0ec84fbf187187990d71d3d84a97bdd6

  • C:\Users\Admin\AppData\Local\Temp\Cab9ED2.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\Tar9ED3.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b