socgholish | a24621ef68f349b2231bc0a74e03aa89f4e1cf4d275b019b28ab36e7b618313a

Analysis

max time kernel
143s
max time network
145s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
15/06/2024, 23:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b0bbc1919c382273080c45319e5c8628_JaffaCakes118.html
Size 232KB
Sample240615-3rdy1stemk
SHA256 a24621ef68f349b2231bc0a74e03aa89f4e1cf4d275b019b28ab36e7b618313a
MD5 b0bbc1919c382273080c45319e5c8628
SHA1 e45f3f2065239802fc5f9a6c25b54387ef9a9963
SHA512 8368c40a558dd466e230f7bdd40c3de2be6b0caf6ecaa2ff081598bb25816da770e6ded42818ea16dcc6cf90f0de940d0d9b859581cab3eb37ea6bbeb2e47d24
SSDEEP 6144:L+RELVzhXkA3d8VZQvzwV2lms5JBpknvjXGXgcHNSbZKQx:CRELVzhXkAN8VZQLfh5JBpknvjXGXgc0
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

socgholish downloader

Malware Config

Signatures

SocGholish
SocGholish is a JavaScript payload that downloads other malware.
downloader socgholish

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0c38d0d7ebfda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424656941"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{37727EE1-2B71-11EF-9520-E681C831DA43} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006fb3d087c4ee9c4bb22550fd83a03905000000000200000000001066000000010000200000009ffcf18b1bc06668145fc843e434a0343d7cb449a043d506cdd9c59de3273884000000000e8000000002000020000000ddc6cf92cd4ea22c85f8e8edbdafb83b7a74bb729ff48aa022221fef23a214029000000097bf5ab1387bf12b1b871955532ace9b0cd4442b39d3d5ac44a7bbd5fc52580ecb8f15c4aaca5443385f83eff12ed07afac7a5012bc9da372ff6018134223c6308e53a2c27a1ce0e4be195ad6919fa7fcbb5dbf67820ede6890d4e6eef42307191a4292a883701e391be3184f231842c4b546bc49af3216633e7343d86f30f8f76f578b3b76bfd6c5ba8ad46c8a6a363400000007e82644af735bfd049012c58ed9c56828dbe2a27b7fe8bb847548e49a1ed15a3812173dc2b9bbaf5e94866406752ac5006784545e2ec7388dc3f3deebbc0ae35	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006fb3d087c4ee9c4bb22550fd83a03905000000000200000000001066000000010000200000000eea9fe7b18916460cc1da0e77aee66ac32c929f35ab903b05c915881322e63f000000000e8000000002000020000000ac38ab0e4718ac4a43363fa8a0cacf4c676232f09548a06f391f3ca58ff247ac20000000967e3fd90d39f17cf88a64268072e9eeab608c39c5d85aa3a7ead7610e7c2fe2400000003c6dedd3a19c43fb0e7716789ceed2fb545077d6f053bf1bd05977ff4dcad89ef9b53b0952368c7a7d6c37504b9611c2ed6728465c3898c118f4b098998817b8	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2868	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2868	iexplore.exe
2868	iexplore.exe
2192	IEXPLORE.EXE
2192	IEXPLORE.EXE
2192	IEXPLORE.EXE
2192	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 2192	2868	iexplore.exe	28
PID 2868 wrote to memory of 2192	2868	iexplore.exe	28
PID 2868 wrote to memory of 2192	2868	iexplore.exe	28
PID 2868 wrote to memory of 2192	2868	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b0bbc1919c382273080c45319e5c8628_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2868 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2192

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Size 1KB
SHA256 f2155ea5178be453858f9dfc65c59573af68dca5512fca87b93a15a4d26c8a68
MD5 686513adddb8d0ec2f3eb27597f1c6b1
SHA1 70790a3d3843fb7d2ad5c1a9b6c8c712fd19c331
SHA512 40c8c622e690ceca84ba343b6f282db87e90684af054975241d69bfd54bd2063ba2f457f2e555f9d9f25776011c8f6200c67a3ea550ee5059d5c8442f2547bfd
MD5 SHA1 SHA512

Submit Download

265C0DEB29181DD1891051371C5F863A_95776108E5303B05527E9B63C6628F47

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_95776108E5303B05527E9B63C6628F47
Size 472B
SHA256 edc5e96ba83bcafe46e94e86700ecd16a6161687e8f346ed3019be3940bc3016
MD5 bf7b4d89b2491237c5d2481e6ff2b938
SHA1 5fb34237868a4569f31dcc88bf27edabab5b25fc
SHA512 4be56d891cc5688c817ce7821fcb85cb153b63b5af3f67a1dcde3c784ea110d564c7559836513819ed3237869784bbde84657e822c5714fd7c626ab5634fa48c
MD5 SHA1 SHA512

Submit Download

265C0DEB29181DD1891051371C5F863A_DACC52A1882A05AED14688828CFAE295

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_DACC52A1882A05AED14688828CFAE295
Size 472B
SHA256 c4ce93f426bf31ae770ad35b266132f991e11d8d4e62d2343b017e57587c3f77
MD5 17f7dd03723fc449a753b152f5e646dc
SHA1 d0520d5747b0ec1d5f4a95a8a1beaafd6e18a2ba
SHA512 5cb453541b0dbfe47f281434827570f1e3987ab3d34e51754c2f2cb676a38ab7a81c792fa085a1dfa6ad33eb9bead2f6f72075b770b8a76c6700c78193b90403
MD5 SHA1 SHA512

Submit Download

CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
Size 724B
SHA256 0b720e19270c672f9b6e0ec40b468ac49376807de08a814573fe038779534f45
MD5 ac89a852c2aaa3d389b2d2dd312ad367
SHA1 8f421dd6493c61dbda6b839e2debb7b50a20c930
SHA512 c6a88f33688cc0c287f04005e07d5b5e4a8721d204aa429f93ade2a56aeb86e05d89a8f7a44c1e93359a185a4c5f418240c6cdbc5a21314226681c744cf37f36
MD5 SHA1 SHA512

Submit Download

24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Size 410B
SHA256 7984f639f1302d3bcb2a06689807696ca50d984f60cf60c241ab1aeb42cdb3ef
MD5 4c0beeb9cbdfbf4874a5d6e7a95dce8c
SHA1 d1e49db84523f48b53584fdaa70971a36ac4ab57
SHA512 c07c592599ef7052bcb7331492c0a5b37c8b55a651c065e9c253db7152dbfdc18957a133d311cf76c05f72f910edfefe1c061bdd9fd26c4574085f3e2b6ea271
MD5 SHA1 SHA512

Submit Download

24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Size 410B
SHA256 7e56bd49c4c12d73fcb63c0173e3d13036bd54a0fd499904062c1d0a8e6fc712
MD5 89e7499ae024fa17e0254f9fbd2bb9d0
SHA1 bf520e783d7dc96020eef291ec428bb7f203711e
SHA512 6dc5564ccb1294f1ab4e0fe4ddc520801717f896d83dbc29474573a7db761612aab497334b53088d8f3cefcd77142d5be8f404bb2c87b342dd0dd7b591c39a7a
MD5 SHA1 SHA512

Submit Download

24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Size 410B
SHA256 770849f6345900896f4b191f230d10eb7337af390c2364b40d5b1cf968314f05
MD5 adcaf4f484d240783ebcccbe56d02ff2
SHA1 27a79adb86edc105a2225687ecac077f92ab9c80
SHA512 80c0f7732a302cae8dac53b8313b97645d493f164015cdcd434151457d0895711dbf58dd145e16586017680e5d8fca8b3e487e6d81b19442d91e1a93f1d93824
MD5 SHA1 SHA512

Submit Download

265C0DEB29181DD1891051371C5F863A_95776108E5303B05527E9B63C6628F47

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_95776108E5303B05527E9B63C6628F47
Size 406B
SHA256 ffa8d47700a94ccd7258768b8fc2094fe46925d2781b04133c01f3869650ef3c
MD5 0b16a5b5896e3af2ae0c79e3edc261a4
SHA1 f9d022caf829a65b0105b5b72fb27b94b0de215e
SHA512 b946b883a91b889acf446e6c02b89be60aad447e0a59fa36af2a2118232e458f44821c62264a17f2c8204a3fc5e361e4d3c936131693137a217d432427ab09b9
MD5 SHA1 SHA512

Submit Download

265C0DEB29181DD1891051371C5F863A_95776108E5303B05527E9B63C6628F47

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_95776108E5303B05527E9B63C6628F47
Size 406B
SHA256 711949813e5fc3f1dc0be249e0805901638834809e61effe75faf49558fd13db
MD5 5767d819ed0af51d2ae24f22047383a3
SHA1 2baf68bfcf406891ebb7481d8defdc2b29fccd82
SHA512 239c06abcecb92d27b7d792020c43b134a83562ef2f976fb6772563e1ee31ef101b6c71881d037398f4b31eb547ff1cb07ec467d1efe6e9717a5bc96413de0f7
MD5 SHA1 SHA512

Submit Download

265C0DEB29181DD1891051371C5F863A_DACC52A1882A05AED14688828CFAE295

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_DACC52A1882A05AED14688828CFAE295
Size 402B
SHA256 ca6a9b5353254bc718fe8839604733dfc1d3b3e038c82df3e5804ce6ff7093d6
MD5 d3d29df878fa8a0eadac81a6edf06fee
SHA1 849ea6ba779764be933942d9c2683a4035f079c2
SHA512 1e4ec47c5930d401d51de42267d73f4e2beb5b0e1c22c67f89e824b04a9f98f2ecd4f85f58230d064913b47dd80e1d66b8aa6c1fcca623fcc21a95e7a6e25c14
MD5 SHA1 SHA512

Submit Download