socgholish | 221de89ba236e56f44a4b2c8d1d9fd9343a9e14e0c5e1827046e5872edc941ee

Analysis

max time kernel
206s
max time network
265s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 22:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3b3ac0c638f7b5e5e3572087b3943aca.html
Size

92KB
MD5

3b3ac0c638f7b5e5e3572087b3943aca
SHA1

1a286286c979ef04958ca9b985ab5ebf8e81e97b
SHA256

221de89ba236e56f44a4b2c8d1d9fd9343a9e14e0c5e1827046e5872edc941ee
SHA512

1b181310e70e5a4f4e9d7887f40cc1fa11d7c9649edbcedb1a2a03f47a2d1c69fbb07e4bda104a0435369545e098f3cd7e352a72be0c3d755a36e92cc8e29c2e
SSDEEP

1536:5HvYoFXUP88Gk/lNIlpzt8k9NKtiHGcpOnLfYM0oMEHvOyZqxUvC93IxgdR6TJGF:5HA6S8fk/LIrzt8aNK8xutWMOyZqxUv6

Score

10^/10

socgholish downloader

Malware Config

Signatures

SocGholish
SocGholish is a JavaScript payload that downloads other malware.
downloader socgholish

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c1930000000000200000000001066000000010000200000004398499e34ff997c43eb32051c0514873bdcb56e4745234b2daea5d4ab31b7a0000000000e80000000020000200000009bc5141807cb5600be50525d6eb73fa2a38577f2dd13196c1caa9133f539dbba200000002af7b7d9dac6dbeb72f5f8c7ede27ae48e0c648eefe4bd6a2ec8ac6a2137dbbf400000009b3a8614727987c83f8897440300d50e890cf16b19a3aec315010e7dfac5a34b6866d6848248afd746c3d4a28db1dd11fb452d5c3ddca41270250513497cfb53	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411091970"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c1930000000000200000000001066000000010000200000008dddf2e5695a98475a90a851222d50233bfb395e078f0160a12348ff78df0620000000000e8000000002000020000000b8515972b5677c03cbe5b7294d9f0858f685bba609feb8ba839dbcb647fa2b8d90000000f6963d41f041263bba6e0aef52170709a463275ec3c769e49e007a5841f07d680c227be4932788a3045ffc9f77016d159d6dfc7281e44532214e3d3b0414b6f0cbb45d5902480b3b9f7d927b5c0ec2cc10b2e959031f2a11353183c64d799192ee9ad9710f14d3496ca64e391be33dca36709d9d525b4d9d8c704776b0714aaaa5b9b4fd6c30667d461e04f11ee50650400000006c9c31817d89fd7fbaa18c7b07b9e0078f50aa8fb5b4772fe8cba44c1fa9bd6ad5d953d3190b56e68e9a4478ae9fda01629bc20c970d7dbfd1e1e7b33dc95585	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70c9cdb91e44da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{ABD83D01-B011-11EE-B735-D6882E0F4692} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2300	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2300	iexplore.exe
2300	iexplore.exe
2900	IEXPLORE.EXE
2900	IEXPLORE.EXE
2900	IEXPLORE.EXE
2900	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2300 wrote to memory of 2900	2300	iexplore.exe	28
PID 2300 wrote to memory of 2900	2300	iexplore.exe	28
PID 2300 wrote to memory of 2900	2300	iexplore.exe	28
PID 2300 wrote to memory of 2900	2300	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3b3ac0c638f7b5e5e3572087b3943aca.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2300
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2300 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2900

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
a4f70334f4ae5d31134d96198c5d9f6d

SHA1
a35fd3db39c29647905b6fb5974b1b65c04a49e6

SHA256
920e172efe035402824a90c23a18344db7db60d2c2cb19a074a5888d55b66baa

SHA512
47b11d1fd196aed6f9c993f09e3cb2f18ee8f684f7c337a28599717c686ff7dfc503cd8e35c11bc214769b336c9487fa6722fbceba3b4623dc3613ffc518d3da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0af3b328fc4bd44a9cb6972cd0a85f3b

SHA1
f7190f0b5154b3d7906bba7c6c78c87175bbd3cd

SHA256
514a590ee4c0b1f63d9892851c0051f8aa9599753b8911de3b5a58607a359e68

SHA512
2601b101dadc18fd4b064acd456857e8e683c4e1994170184aa548c4cd78c23be7dc9a8a9dd3e634befeea111c84581e01469b4530382776b1fe931dfd9e1937

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8b3b0e5a886cfaf86af3674dff4298bf

SHA1
3e65c9445311068c32aed12b97e533854abfdbd7

SHA256
dd89a911cf93df989697a39f2e46021a39f992fbc552c21dc9dae2b72995204b

SHA512
5b739f6f1ba98f9a1d94f9def2f83172d1262cc6d6a7c04725a5f81a48bdcbbd33aec3fe2f168961f17534c7dfac1aec4e2227de309aba633c1e482459bd9db7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ae77c05304ad62969822e1849f8c9801

SHA1
2d43ddce43f8852a56b229d31c31f6ab316a5619

SHA256
43c2a024231d1fea7e430519e9119c0f64581780b46eb752bf00adc2e4c378b1

SHA512
c53841209d4f3f94546e77976d788616bb23054c97d55a3a171755a74cd31379755cde18672e1c2d46822e060d01597b797ce525787f13430381886adb3bab8a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2e5f340c54bdf9ca953e26f70866a459

SHA1
b8681d07c3bb8e7764c7f3292eed795c42705f92

SHA256
6d74aca4f5a12a03b46f6dacabea47cb90fd1cf0747639a9ccbc972f33361988

SHA512
765c82475f865a2c403275f53915a357676d21357b48a5ac7abe639e875cf67cb78c10a20a0b38698f050ea700cceea1e857873f775060d07c78fe65ae375482

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bc0393c955ececc8987ba98e4eb20b22

SHA1
be5057528e66d5628c10d3c816826e1f6e43d13e

SHA256
a0af4710e09cf85d07e0e99d26ead90baf5c16b8e3926dbe945ffbb836521fa8

SHA512
000c6c3d9374254c3dc0c32ccf1f83b874fc429fbaa9bba675aedbd3e9b8b859a94030f7af93f1e5f1145d3ed2eefb666cfd4d1ed8cf8d579b60a5f1db3ec875

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0ac28302665e699acc24a171796e4f02

SHA1
49c67ba190b90c350006cbedaa0d95466662c36c

SHA256
f91cced6ada3b7ba83843e7116fe0af27a2597d75dc24c471f77f4c40a9ed53f

SHA512
c752a42864d71d58b719772a351bfed965b20693a2798325a73a6f32f558563b74bb38adb79b22285ec950241fc84656c3108a73dfcf8bd6e54851bc753a107e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7ed380c24d1310ff742dc5a87271514b

SHA1
1cd7a88e0aefe259b8f3b1367c327ad13a393866

SHA256
1e449fa0fc4bb1febede673f7cea264d018003a1bf4d43607c41bd6822a5b979

SHA512
463b020f1529a48dc8018401557ccecc11d8d69ae1a27812f8be227a5ed0427261071a4076046f51f0cf8a195e7071b3abbdadfcf362935f0cd5efe894b30e81

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
feafa3b96a8409468d9f752ce09fe0cc

SHA1
6e78bda89a8f034f3a64e5be1797a3215af1f2e7

SHA256
f962117ffc3d261e45cbc186ab7e5c1e13dd07ee4ef6e46c674aa7ab7ad9e4cc

SHA512
3a56895a3e180619fd4f50a8ffb80825d66338ff055c96862b50f0149bfcaeebbbd3b759675975aa13dea292254b555ec81bf2b817b6007da0004f4273516cef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5ed6d6c0d478f809c268ff8b9ee2ecb1

SHA1
c930909a3ee25c9d13fc573a5ca34565990d75fe

SHA256
8e7b8c52a079aca81f365c077da77f8fa01b0e91d3ae044278525d6bb7e01481

SHA512
bfca82142aac5313d3dd1fdf9102646eb887a3c948f88b2f58e4e8861cf9f68b9cbd5daa16eb450f25dee97701c9599f5381fb7ffa7302971b3429d4894aab3d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CFHPCFFP\cb=gapi[3].js

Filesize
133KB

MD5
288c5ba5b7001fe841c32f690f62cc93

SHA1
29aba9d8e4f7cbe25fa5e64b9ecbe256e51fc789

SHA256
c2f33dc18eae27d4e878bf837dd97f1bde5151e44b0271408535bb93265b8c52

SHA512
e375d41344a086d35accfb02bb1f91e2dd383db032af387fc3d6b1230057cc5e432e9b2cdd976e51425b4f587391d42f4d9d857c2e6f11e822a65edcb85f1c9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\L6MCRSFJ\platform_gapi.iframes.style.common[1].js

Filesize
56KB

MD5
f6140cf2e81a9d5b9bc96970fe1946f6

SHA1
e18cb20a08d0c13d44b72e36e9560aec2187abce

SHA256
68cc8a99c8ed5cc0eb3aa2146fd34bee0051bfd98faa3c03b83c78b4a12a8bd5

SHA512
1f61bf7228ae9fc1b36249223f4ca0675da05beaa6c00b28b7fff500e0527ee237d139eaf6793ece67f8730dfff0207bf945a848795aab7c57301433449a8acb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8D9.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar987.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit