socgholish | c48c1c7e35401ca14d5b89ead49163739e7ed3bd1dd368b2255738a2f985a14c

Analysis

max time kernel
147s
max time network
152s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
21/08/2024, 12:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c48c1c7e35401ca14d5b89ead49163739e7ed3bd1dd368b2255738a2f985a14c.html
Size 288KB
Sample240821-psy4pasbmp
SHA256 c48c1c7e35401ca14d5b89ead49163739e7ed3bd1dd368b2255738a2f985a14c
MD5 b34307d87eed1985e63699cc5feb40bb
SHA1 45298f013d1f0230dbddc78b221a7f8a7fc17286
SHA512 2771140c629bc4c958cb11eaa97c06223a74dff27f09c548d58d39975b5784e5615007cb65d1fa9430ef7498aa984c03e23d20d612ff3dcc8638ad69eabc62df
SSDEEP 3072:IZcF8znJ2yQY8/g8SrytgSWm302HlDNFK+Hz2gr1Z/NO4C7m3ytgjq7TdEd8CfWJ:wnBQY8/g8SkytAq7TdEizkCt
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

socgholish discovery downloader

Malware Config

Signatures

SocGholish
SocGholish is a JavaScript payload that downloads other malware.
downloader socgholish

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b70000000000200000000001066000000010000200000005d06642122e9fa65b7b863117710ccbf4cdb51e8d479b9e353869edd2f37fd48000000000e800000000200002000000026ee43cf8bc68c4317fc38d809b3bea83e65c77d8e61c313a171735e203652a02000000004a35e9368dc535f02ddfff0350ac16596b0626baca99414208e66b15407e43640000000425623efad596ff637e9ba721660ecff5d250be1a133ae0bb170426b383ef89235d407e1f0dbd23b82cb3d9f96ab13c227e8d88820e4ed431280e958b1e6bbe0	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000bcc148c1042272d30cdd2718229976127e467de27c221b9084ccf51a8f26c1ba000000000e800000000200002000000081dc43bde8699ddb09ac407dde718f1d410c332f8b0a269b88c065bd83454c5c90000000417fcc92292b4ec50a40da10c7e22dda0906941c5239d70426f4dbf7842450d31e38ae915c47c967e6bec43bf4bbfcb0ed6fc404767b54a926dabcc14c960a347c00f3ff1196cb60c43966b298c995fdec3e2ac3d2d29970412f3f15eb709605dc1a017b5dd5d82237830b7c4f0dfaf4f2601bf7414a57f595d47741f78ae5f520cc403eb2b70a52b5fb709d08968d8640000000c2ee50a8213d67cad41a39b08b4ce669ea467a911e0cdf29ab3b8775a51a9bdf4bf21933968dee1843e676ce2bc884ae4e61e2eb36dc21953102b3e5c6191915	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d01ad809c7f3da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430405644"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F3FA5B11-5FB9-11EF-8FA3-EA829B7A1C2A} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2432	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2432	iexplore.exe
2432	iexplore.exe
2736	IEXPLORE.EXE
2736	IEXPLORE.EXE
2736	IEXPLORE.EXE
2736	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2432 wrote to memory of 2736	2432	iexplore.exe	30
PID 2432 wrote to memory of 2736	2432	iexplore.exe	30
PID 2432 wrote to memory of 2736	2432	iexplore.exe	30
PID 2432 wrote to memory of 2736	2432	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c48c1c7e35401ca14d5b89ead49163739e7ed3bd1dd368b2255738a2f985a14c.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2432
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2432 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

05DDC6AA91765AACACDB0A5F96DF8199

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\05DDC6AA91765AACACDB0A5F96DF8199
Size 854B
SHA256 a8accfcfeb51bd73df23b91f4d89ff1a9eb7438ef5b12e8afda1a6ff1769e89d
MD5 e935bc5762068caf3e24a2683b1b8a88
SHA1 82b70eb774c0756837fe8d7acbfeec05ecbf5463
SHA512 bed4f6f5357b37662623f1f8afed1a3ebf3810630b2206a0292052a2e754af9dcfe34ee15c289e3d797a8f33330e47c14cbefbc702f74028557ace29bf855f9e
MD5 SHA1 SHA512

Submit Download

070E0202839D9D67350CD2613E78E416

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416
Size 1KB
SHA256 d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb
MD5 55540a230bdab55187a841cfe1aa1545
SHA1 363e4734f757bdeb89868efe94907774a327695e
SHA512 c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54
MD5 SHA1 SHA512

Submit Download

24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Size 1KB
SHA256 8ae57582a1b456adc6d7322a7bbe2c494c56cda191430c4189ee1dc4fe1841ee
MD5 8cdf008f3029eacb87eea0281f7aa1cd
SHA1 94e22eae3c5c41d8eab1e7f8989b42e2cec3fd62
SHA512 5d83f2eeb2cddf4a2a7f1cca403b20d07d399ff2cafd90aa82f8e7b5b43e5dfe37e7f6ff08cf07535c7431ca8e7b994e8fea586a60606cca60f15d17aba03e11
MD5 SHA1 SHA512

Submit Download

3C428B1A3E5F57D887EC4B864FAC5DCC

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC
Size 914B
SHA256 cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
MD5 e4a68ac854ac5242460afd72481b2a44
SHA1 df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA512 5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
MD5 SHA1 SHA512

Submit Download

C02877841121CC45139CB51404116B25_9CE832D646FBAFC5C4ACFC523FDD84AD

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C02877841121CC45139CB51404116B25_9CE832D646FBAFC5C4ACFC523FDD84AD
Size 471B
SHA256 ef783788dee0dbb9196405da81919f7a10a9b32c0ae5a660d6603e91847c8be9
MD5 7ad371d64053fec0ed901f12ef3050fc
SHA1 7f72de4136bd3a06dd951f547f73cf260b39bfee
SHA512 419d24b7e05c44cbfe6e85a741461efa52f1756b750c97ff0dc80d58b322ff18eb7c109f308c1b33a2cc04f054759b013d65bad5025f413758b08a5c02c59f48
MD5 SHA1 SHA512

Submit Download

F0ACCF77CDCBFF39F6191887F6D2D357

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
Size 1KB
SHA256 df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
MD5 a266bb7dcc38a562631361bbf61dd11b
SHA1 3b1efd3a66ea28b16697394703a72ca340a05bd5
SHA512 0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
MD5 SHA1 SHA512

Submit Download

05DDC6AA91765AACACDB0A5F96DF8199

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199
Size 170B
SHA256 31d6725316adf6c604a63af6a9869c222eedb92cb978742dde607d36b1d4fc91
MD5 9592726d136bcb3cd8040d147956ef22
SHA1 ef0daba7f07daff779d808e9da3999b662b7a409
SHA512 f0b9c610ed2cc20a537b2bc302eaf44242600caa63d2f64b4b0e3437e98b12a4d231b6aa7139674161a031b2bbe3a698cb73e7f4377255bc6012ccfa12dab344
MD5 SHA1 SHA512

Submit Download

05DDC6AA91765AACACDB0A5F96DF8199

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199
Size 170B
SHA256 d84070d96a8bb341d320f8e1939246daeb84fdd3179986f57cdbd0ed365c210e
MD5 6cc8170ba086ee59bbbc39b1ded263ee
SHA1 b1d93bf553ce3290c0be8b07bc2a8b2260fda966
SHA512 232c0b86028ac0ce054042626691f4af6c15a701274974d7a37e852f2597470e95125972db923b0645e98b0d81f9a052997c7b03367e401e0dd3fbed6114a9ff
MD5 SHA1 SHA512

Submit Download

070E0202839D9D67350CD2613E78E416

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416
Size 230B
SHA256 ca2f940c7946d6b19b56ee77162e15ed3dba4a0695c647b01d049c00ed651449
MD5 a78a8ccc63146cfbafd33b59d114e302
SHA1 5d48bb714410893a15277be7e5ee2d22cd030249
SHA512 ac3e73f89efe4995d2b96d0d46d37a3722cc44e09e13e81643545cf84ef5596975b78acc6adc2bf0200b67a33010debb5f93de31b29b6f64fae1750bfa9c747e
MD5 SHA1 SHA512

Submit Download

24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Size 410B
SHA256 e5e520982901fd20270347d4b11dd4f1088f981f5c9bbc37c9d7a6b48ee30182
MD5 0c4881663837132555627128bd1069ae
SHA1 43b472817711a662203a9a7e672ab8f48daab963
SHA512 12c55f060e1501855729db241c3785db1a4b413dd16098f2c2076d1ed175c8b1781040beb94dccc9cb82789281c399d41e8bcbf723e7cb1011370fe6ac1a0be9
MD5 SHA1 SHA512

Submit Download

24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Size 410B
SHA256 3a106a3eae57b2a39a4feb7baf19f04390ead711261c80f0843fb6bd4a363162
MD5 d225aabcae49c5599900eafdd260ed5a
SHA1 dcff537c844012e66abd5a7770b10aa8d7a84620
SHA512 fd50a123e8ccb056b04d1b504070c044187df4aaa2a73e9f3d1ef056fc52f716cab8f10c0a36d03d1b967712024306a2bd09bfe7d79d751d0735f35d2631e2d8
MD5 SHA1 SHA512

Submit Download

3C428B1A3E5F57D887EC4B864FAC5DCC

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Size 252B
SHA256 95c4184fcd3cfb4e38e6211903a6359898f10e4b67b7a4ce292da1f11f191a11
MD5 c9dbbb996d3ffef87de62c3d8d9a83f5
SHA1 7f1d96a443128b98f777c0832b20db21656e176b
SHA512 f978be590dc76b312a0eddb79ba2a4b7e62fccd5d4f45525d6ec1fb1192e11b27cf61a297a67330f915b46ebc4a4bb3c758cc329af4b2a92c4273f6aa7d15adb
MD5 SHA1 SHA512

Submit Download