socgholish | 1202b9ed60b436d961661fc2414a6a8fdeb8c5f46744fb05c1a9495e4803f332

Analysis

max time kernel
149s
max time network
140s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 07:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0ef0f179d4108071af4aea94e7e78409.html
Size

69KB
MD5

0ef0f179d4108071af4aea94e7e78409
SHA1

64ac7878a58e77a13c885ede141503d622d9b660
SHA256

1202b9ed60b436d961661fc2414a6a8fdeb8c5f46744fb05c1a9495e4803f332
SHA512

ae960d815d6fc825e52b96eca53e1d9e37e5bcd04a0bbb20b397ebef71dee745fdbb483c8fc8930c7b0a18eb0a559233a1ab4f779a32aa61613d9772f177494e
SSDEEP

1536:DHvYoFgP88HcO8tZqxUvC93IxgdR6TJGv8f6t3HF+f:DHA6G8m8tZqxUvC93IxgdR6TJra3HF+f

Score

10^/10

socgholish downloader

Malware Config

Signatures

SocGholish
SocGholish is a JavaScript payload that downloads other malware.
downloader socgholish

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{62C7FD11-A4BA-11EE-B84A-D2016227024C} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d60000000002000000000010660000000100002000000046e52ddeebbfe693911b769e12a9d70508edff714bb88c41afd9ed5419638a8a000000000e800000000200002000000091ee39fb4c625735b6e79ab26a7858a1ff07739ea9f58efdd3f71dc9246745fd2000000060a60198bf6497557ebe731dd0b933b29b1a92a8355bbef1ee87027d3edc630f4000000025ce2b165d82c15fb7ae125e71f75268ffd445a54d05ae7677bdb70255ba312cf710ad29f62b56825da2084e07fc9e5d718783029f18bed2a1073057fdf6c527	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000b622ef1d4b8566b23af0ed45b6307378f95226a4e30530ecd083d22d844fc1ce000000000e80000000020000200000001a1fcecd73951c94727a5d9b32ffd85b41bcdf316c8646fe633cdc2e2182514e90000000a27cfb43dd05f666a6e9207c179d2db3a210ff00c16f31fd7b7e697389a30e840ebc21c7dae39581ec95ded4b4954dee45885c36a84c8184b8fb6937df3b948d40d84cf8f480c67a755af6632141b96b3fa7573149a2f9d6e21824b24aade2235a9f48c0a982287413d1cc77281257a5a9a42c676e0ec65d5a424af47431c2bf31fdf878d78e62346d03c1c532b490f140000000ca5f4a90ba528dc291d02853ee501df5d934bf409bda7ab460ec9bf594aac801bdb1d79e912907440602199024b5dbd5281fed1bedf0f0b05b5623bb65d82927	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409844965"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0197640c738da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1656	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1656	iexplore.exe
1656	iexplore.exe
1628	IEXPLORE.EXE
1628	IEXPLORE.EXE
1628	IEXPLORE.EXE
1628	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1656 wrote to memory of 1628	1656	iexplore.exe	16
PID 1656 wrote to memory of 1628	1656	iexplore.exe	16
PID 1656 wrote to memory of 1628	1656	iexplore.exe	16
PID 1656 wrote to memory of 1628	1656	iexplore.exe	16

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1656 CREDAT:275457 /prefetch:2
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1628

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0ef0f179d4108071af4aea94e7e78409.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3b87bf2aa88425a9a7cc09c346074bac

SHA1
7967d85c720f4cbce240e38cf4df37986718e741

SHA256
f95c8b61dda62e7fde57733473c73b91678843b1dee586c2e7f3ef563a474a48

SHA512
088faf73b63e4030d853de20ecfc44cc56efa2c5e6b0927c785429ba76758c91ba35332ca18060aef35f43b5050cd212609f1a453e77f09750db8c6f87a597c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ba46f64e518469c639d113b63749ddf1

SHA1
693b0039a2be75506ead7ae4b433a9571bb39888

SHA256
7be03b535e950357743419f5eac18438a98a5b86b442a480a5425093da25c3ba

SHA512
0aaa0e75852ec6a58ce8b7bef16a32155f15bb504e34beca5149d058ac1ca9b575ab63bef7f8fb53f54065178710b896e035b8b3cacecdb0eefa65990b886280

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
89a65f8cca13769cf9663e011defbd15

SHA1
3f1756d4dc0101e04b3402ee5ec0dbd5d0554b1c

SHA256
5bc50d9ab6e622a9566b94ec65c5a0fea4c54538133f57c38170342f1e58b054

SHA512
7e6fd74decdd6a12f3428f3b7212855aedba6b83172dc2c2efbe537156bb883400df4de67a0b9d17dd6faba07c7fe2d07b549d6c938d805a962af2904db1ba04

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a6562306a19d89b04ba737e403c548da

SHA1
d72e044521f6829fd1014159ce20bb8fdec4ac8d

SHA256
b09ba0be3982cf05639b57f8a8e18a9b647ba5bc9d40986812039d402186a237

SHA512
27c44799e9d069ec1c0e7ea32e1520ef98bb831b58f73eb9d34198757a4c8ffee0820dde5c4e50bd6095e04d41d4d76d9fed40fa7e5a1f1d371153cbe9b14982

Download Submit