Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    141s
  • max time network
    146s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    03/12/2024, 05:35

General

  • Target

    bbf16871343eeed70d349932c69f1379_JaffaCakes118.html

  • Size

    213KB

  • MD5

    bbf16871343eeed70d349932c69f1379

  • SHA1

    690d0badf8bf377560811b19fd6960c18d226328

  • SHA256

    3532d5320a1ff682385264d80a3ed6859814020b21ddb6697202b857aca0ca68

  • SHA512

    122419ad5b12c95ade950a4f7d14ef2e67dbeba9dc2f6ab35b73239e468423ddbfee82a5d2e70e306789e04f9c0a7a00255c88be835808a8c3e686440a7da8fc

  • SSDEEP

    3072:9BmiOq/oEM3uWe6vi9xyyrModahlsZXvV8XcbqiB2tMc+VpXpGPb:3wq/xM3wLhvk

Malware Config

Signatures

  • SocGholish

    SocGholish is a JavaScript payload that downloads other malware.

  • Socgholish family
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 34 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\bbf16871343eeed70d349932c69f1379_JaffaCakes118.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2844
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2844 CREDAT:275457 /prefetch:2
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:2448

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

    Filesize

    914B

    MD5

    e4a68ac854ac5242460afd72481b2a44

    SHA1

    df3c24f9bfd666761b268073fe06d1cc8d4f82a4

    SHA256

    cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

    SHA512

    5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

    Filesize

    1KB

    MD5

    a266bb7dcc38a562631361bbf61dd11b

    SHA1

    3b1efd3a66ea28b16697394703a72ca340a05bd5

    SHA256

    df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

    SHA512

    0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

    Filesize

    252B

    MD5

    37951dea4333cad4d056781ffd4113ae

    SHA1

    9f6713ee350ce1bc88d82d92c1408535e886b0f6

    SHA256

    8a663b485d58b9e8e61f82981d0d4cb770b54027a30184622423c8017b92bef8

    SHA512

    34e1489cb72381b721ada3a9d22dc6699110648d610cac73f2a513632e3f5ca9b14213eb858c9014f989760c4b83b6da4be44ce05c6d818032ca4ca86bfb8543

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    556665c8a6b1a94424448e95d464760e

    SHA1

    8e3a58d62e012205b84879ada87332f89db8af24

    SHA256

    2bad93d761e84711ec0114b3e22562b0d6ef5ff6bc94d27c8cdcaaa77b55c63d

    SHA512

    3fc8c0af5f423800a5b4131fe4c30b655ec22b614f97912e0f5b9f2c4b33f106421fc558cc5838aae5ed27ec1708fc2d3d37c672e2517ee877695f2b5078f921

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    c8868fd2f351403ed098b54eb2f50e93

    SHA1

    e24a6f6dfe5ee26a35c7bcf227c48fb815e5b7b8

    SHA256

    77d18a90e3a9b57729d2e0bc3b00f8fed986c172f981b9291c27d4157a1c724c

    SHA512

    079bfdd224f148a742e39ffcd8efe8f8c366dbdb640e88b25594be81e83c34251b189b9dcb8d352f128182d88a28480c7ffdd867b1fd63999969361ddad0cbb7

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    559274ea2f57932531c0400f2c82e4f4

    SHA1

    4450ce9e91c1b07aa71389c1ca668d603cf3d992

    SHA256

    77a40baee64a4c62a33f217cd782884038ccef37a4f0ccb8330ba5653b067125

    SHA512

    cef5ed9375d91e9f309e3594e9c9b3f25d1d29d92576c089f1f6e49a0634d604649d95bfd5e4060e34d3f82f25003c28bf0daf1f94d9b9341224646d6361157f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    9914887c7366037f386660ff8de61371

    SHA1

    3dd42aa51754c136d7f4f84a2964f26f3fac124e

    SHA256

    c55dcf065fcb4fbbb795d297d9d8c31ea875e2fcd10b6299f6e86802143409f2

    SHA512

    dd7779ce122fbed22787685b62dd5de77b3ff7fbb61883e2407e29df5693bdc54ecf5653ccd8392aaf7f6c0268976746f34310f38f9a5f2ad5145db419fde176

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    21951cf7b5d49404f5f8c66dd8ccb02a

    SHA1

    0da934249a51cafc35bc62d92cd08e382290fe82

    SHA256

    98ee5bfd3517e964a5f8c9667286e6e54da63d1689a6c0ec04a16e535ed1a401

    SHA512

    43e87556033e8a5fc5e4742b34f934ca7b4fe703edc70f4c816819d42c0ca26860b90af75127760640f19c64f417aeceefd43d1fd0a0e9ac85ad598f013d0b05

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    f8f8d8d4bda1acdd03a526fbd644917e

    SHA1

    61da8d12968be0723ed96323db2f454d02a6a203

    SHA256

    a088f6fcaf3ff380c3dfeb5566e064d3f85adfc5cdef2682d7bb2c3bb166ed6a

    SHA512

    7a9388b8a268cb3b02ee0e76b7892eef434b53b7d0b07abf49b8ec2a891866d3a2f735631a239b008a8098b37f912ccd8888bb3a88dea73a080abd7f7a7a8c79

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    00c5ff7e55687e15779fb3a5ca8cc3db

    SHA1

    8c2f32716a8cbeac4c91030be88cbd2b47a7e90f

    SHA256

    decdbd4099f338e7f910d47631a13bcf9967ff8959a34ee18f16d5689c7e2e54

    SHA512

    f8cac306c43efff0400422ab66dfe8f4bb44f0c5a2a7134865ce9b5e5ec9d6757a5f489ac1bc6dc2c086e687eae97070c8573bdbb55be839bed0af181132ff3b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    106f6dbd3076dc9f9403d021a1d954d9

    SHA1

    efcd63dc9c743d301c72206bc9f07ebc3993c847

    SHA256

    0650f4721e91c6167a5b7962349eaef2c66d2e430a880d199025aa53eabd93d5

    SHA512

    11fc3b156419c20e499bb47fbc18d9e1e14a7d559093585580ea65afbaafde400668ba8e38f2303f37327c51093496205fcf31ecf822b09c50bebbaf5edb4dff

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    103f3f73e97d5c9473b9b121ebd98343

    SHA1

    aebf36a6bbea27377a7bfe90bc2dbfb6e60a3632

    SHA256

    55b52d5d82eada3c289048a3f2a8a14bc55f3aed4c1021d4e778cea350b06a78

    SHA512

    729a1871dd9eabc73b592be9d012f6c83da5efa5e407d7289cdff592121f7d9297d7b57ce0e09c4e1138a442390d17152e4866ad8bbf1b4ded5ba02e986b84ba

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    d588642669deb4f3a166d30867c91f09

    SHA1

    4954996b83eb4b0e8301c1d096b0d963d09e6545

    SHA256

    6a34163d3e1f3b6fb3518643972217ffda73ccd604555b22ea809054026bf061

    SHA512

    c1eb9e4ce20adc3a50af94c3585167d953e1ebd4b481cec1642cd5d10222d4ba0e2c234e1a98e2b7655e7ff24707b0e8634f348226a0194fbb8d4666aa643da3

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    df918cf5d6768a8114787b852fa33a9d

    SHA1

    717de236c55d938cb85668b239b5428593ad5978

    SHA256

    5d8681bc4f9ca8b7c5ab0622462bfd904967f6a2f86da4329430dbef252b6433

    SHA512

    fc45158472a9901fec9a416c35b305d79be92922f02e1d96e0661610cc5ebd4dc18208c883825f587375b3bb33fe0494bfa8772ca805e5333cf3c24aa69ffdcd

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    7c9fbcf735c96e49c6203ff98871465b

    SHA1

    32cda0e20bdfcd47e621869ee4a5853e85301f2b

    SHA256

    b990da1760f6bb41a32bffc3bf066c7246c8ad15b128dcfeca2a1d4066865470

    SHA512

    c998555225fb4480d16625aa0f30e057a1e17362ab9cdf923e5088d7a2f18867ac493113fa974f619f96573196e0d970eaccb00262a8f779d6e6eaebbf0c091c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    db81eaafe5a8f4ebefaf4111b6926397

    SHA1

    8c766d0c76c126f1213ac73dfe259a8e52405301

    SHA256

    25285f2b64a65566656db5b97be2c12e6f1101f1bc37e14ce058fcca3fcc87fe

    SHA512

    db1cd68ffcd320f1222d39562ddb15f39a5e3ab562c59e7ef217d17d6dde14532517c3be73ee6bc399926e5c3ddd952850c3fb7d1b480a7c4673c9fbd0dbd4be

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    06189edfa3844e61beb30a4aa4a9dd79

    SHA1

    7ed3bfea946bcf2081a21bd0f1e019311f5ff9e4

    SHA256

    628850e81a6117189e0f2df513cc73a2cb2e209da6c8e57bc6bc4cae8911bb5c

    SHA512

    fde0fea65534bddc788ef73ec23936c525b530a18ef525a874b80e4f41b4aacf7b34f977429e00111eb468b1c32fdddd77615cbdfa7fbadc4eecdbc20d2215cc

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    e0a025fe2ae37029c2386a1dfd0c3875

    SHA1

    c07f3dbe50a7fe260f07994761ecdc1af506314c

    SHA256

    6f422b36ba1f311ccbeeef483b06fdf54384aa897729385fdaa6d3e7b36e5bd9

    SHA512

    3991e68103a45dddeb919941bd989767d0bef7dbcb6dbe7a155e7426d68e6f5907ad606aaa406af545461036d5cadfcd848b57ff83311ca6cada13f2a470e8e9

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    dad41765618902dad9bfbc4cf4e131b4

    SHA1

    4045f29063161ad8be4c53d28bd891bf42c76f7d

    SHA256

    1306ec7a3d40fa3dcaeeb865f47cf776a06c001201a1ba98ff42b1f4e2615e14

    SHA512

    5c6e330af6885abd35b08ec6c1fb6726e7099a524fed3de16210d99c275183a33378fc51e74fea2e6c61d1ed6eb75f929048159e56572c01eb46c10b96cfc3ae

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    2e506355d1b4b32abe6c8eb572d66a6a

    SHA1

    3afd16ba87be16e3af5d198b84969649f8536c4f

    SHA256

    eb774e5c424f98472372aafa2aa77db52f4703a563484efcb57f8c495e1014c7

    SHA512

    41dbdca0fa72354635e7dbdcfbf9ab16f664b2b26fc3a5d1cff641781e35d22d84b5953de2a4371195518f4a017d8ef8242ff45df6f977076207430f55382ca5

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    ce25928d9e54a4662e2e5a00645cc9ed

    SHA1

    6a563b0a5cd112186f6c600b2e361656e0c792cc

    SHA256

    e772dfb557355049f883551f3ad7308445e694284894255d82568a770cfb0a89

    SHA512

    5f9229a2af5fd889ea7c7570d165fbdbc8074da067d7a931d848c803f92f3d8c797e52ada318bf16afdfb32e224214361132b6d606abc2189258cf9dfb3f245c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    217c7ca847a95919fb6a6f9b98ffb64f

    SHA1

    5bbef258623b2172da32b857cbe1776844e83b50

    SHA256

    365a4e6a2b18522b3776abaedab44be32c341c5230e879a1146e70c5bca9ce4c

    SHA512

    b3a06b0d0dc5c9e2677c4f03d8ce24aec80b9b5960eef681505714f4103c0d7f09d462ae7538a29da8ad639170a6b73a57fb994caf4f4d4aa88e2a62e350f117

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    3d7e2203898f896a6ff0443b9b2cd467

    SHA1

    131806f28ebf2195df5f56c946f51deb5a0abdd8

    SHA256

    bf4b5c26ca5df77183614071d7c14575f863a45c4577ae98016528ed79adc737

    SHA512

    8e52f9ad16e1b9afe2d2d8674254012bb723cb4b08bbe54efe2630c9e3e440fb08fd1acfbe26d9dbc3b78cc7d8824a6c8a4cda695abf1356230eab0251201c2e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    337958d08ff0067ef92ce17971cf307f

    SHA1

    49542a18a5b1efaf083f1cabeeba24315a06cec8

    SHA256

    ed851a8cfc2dc27dfaad137494fbb548cf15951099c9da25024736a5f9398bb2

    SHA512

    2a7f93b704a2ea876867115629ebdf3435305a251263d9bfbf970cb9125a9a1432b7918dee1f7b5edf6ae584a15a4b86f14a2bfa87c30c42b357611d60a3fbcc

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    f78fd1b8c2d1bdd62c2cb1423f8289fe

    SHA1

    88f65bc2f4efd0cafe33fe89dc61ae55f1831b25

    SHA256

    2e22c1985fd6abeb9c4cdb328b8e537742705f8fdac0a6ee23bc9f7a81bab07c

    SHA512

    2b8f61074ffe117adbe11ed3e69d2af97c70876e57b6ac462b351e1742eb3242813e821dcf4d7a59088d1a85fee20c4e3ef9bb1945537e7438676c1dee4df094

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    d9b22ffbf461203cbfcab2c7a9d8da83

    SHA1

    ddabe84d7b9f7d6d5923ae5c075ae21228d17c56

    SHA256

    b82f67c934d9975398ef67e0e1d9fac049002344ee2eee3849cbd50c6d7256a6

    SHA512

    da9f5b958aeb9b211a7e129b48c30bf0ae8098443d6d5a3f6d44bbe78f3f1dc0d418aca657fa6b983d4e7b933aa766e7beb226c6d2cfb14946d90ed0c967ee38

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

    Filesize

    242B

    MD5

    39943ca5cd389aa17a6ada84006da8b4

    SHA1

    26c2b15826370e97ceb768832317648ba8a43189

    SHA256

    0ce472b72a701bfee9660a4cc5f298940ace8aa94f987df51f4316fe5653122d

    SHA512

    1d71ee806404ba1301d6c0b05b2b0ab3ddfeb565b0ec8727d309b891e1f1905916a715004a7e7b96c7e9c05cbaa3bebe4f724e8ac4d54786b567686c67912b39

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5GWW47WY\errorPageStrings[1]

    Filesize

    2KB

    MD5

    e3e4a98353f119b80b323302f26b78fa

    SHA1

    20ee35a370cdd3a8a7d04b506410300fd0a6a864

    SHA256

    9466d620dc57835a2475f8f71e304f54aee7160e134ba160baae0f19e5e71e66

    SHA512

    d8e4d73c76804a5abebd5dbc3a86dcdb6e73107b873175a8de67332c113fb7c4899890bf7972e467866fa4cd100a7e2a10a770e5a9c41cbf23b54351b771dcee

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5GWW47WY\httpErrorPagesScripts[1]

    Filesize

    8KB

    MD5

    3f57b781cb3ef114dd0b665151571b7b

    SHA1

    ce6a63f996df3a1cccb81720e21204b825e0238c

    SHA256

    46e019fa34465f4ed096a9665d1827b54553931ad82e98be01edb1ddbc94d3ad

    SHA512

    8cbf4ef582332ae7ea605f910ad6f8a4bc28513482409fa84f08943a72cac2cf0fa32b6af4c20c697e1fac2c5ba16b5a64a23af0c11eefbf69625b8f9f90c8fa

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RLHRIIGD\http_404[1]

    Filesize

    6KB

    MD5

    f65c729dc2d457b7a1093813f1253192

    SHA1

    5006c9b50108cf582be308411b157574e5a893fc

    SHA256

    b82bfb6fa37fd5d56ac7c00536f150c0f244c81f1fc2d4fefbbdc5e175c71b4f

    SHA512

    717aff18f105f342103d36270d642cc17bd9921ff0dbc87e3e3c2d897f490f4ecfab29cf998d6d99c4951c3eabb356fe759c3483a33704ce9fcc1f546ebcbbc7

  • C:\Users\Admin\AppData\Local\Temp\CabA68E.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\TarA74C.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b