Analysis

  • max time kernel
    140s
  • max time network
    144s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    27/08/2024, 02:57

General

  • Target
    45ac56037dc160853370f384ed8cb8a418d3f25cdb892842173b5ab3770cf104.html
  • Size 126KB
  • Sample240827-dfphya1emj
  • SHA256 45ac56037dc160853370f384ed8cb8a418d3f25cdb892842173b5ab3770cf104
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Signatures

  • SocGholish

    SocGholish is a JavaScript payload that downloads other malware.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 62 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\45ac56037dc160853370f384ed8cb8a418d3f25cdb892842173b5ab3770cf104.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1872
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1872 CREDAT:275457 /prefetch:2
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:2468

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        05DDC6AA91765AACACDB0A5F96DF8199

        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\05DDC6AA91765AACACDB0A5F96DF8199
        • Size 854B
        • SHA256 a8accfcfeb51bd73df23b91f4d89ff1a9eb7438ef5b12e8afda1a6ff1769e89d
        • MD5 SHA1 SHA512

        24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
        • Size 1KB
        • SHA256 d10ee069105b107056114cbd3c1a25feeb99c0cfb59f4e6a9d7105dc943a0f58
        • MD5 SHA1 SHA512

        3C428B1A3E5F57D887EC4B864FAC5DCC

        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC
        • Size 914B
        • SHA256 cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
        • MD5 SHA1 SHA512

        C02877841121CC45139CB51404116B25_D71A94740B0CED76EBD7AAE2374CBE8B

        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C02877841121CC45139CB51404116B25_D71A94740B0CED76EBD7AAE2374CBE8B
        • Size 471B
        • SHA256 7ab4f326e68d3650f663f91f93fdd0cd5ab88d22bc32e59c40b117312bc002fd
        • MD5 SHA1 SHA512

        F0ACCF77CDCBFF39F6191887F6D2D357

        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
        • Size 1KB
        • SHA256 df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
        • MD5 SHA1 SHA512

        05DDC6AA91765AACACDB0A5F96DF8199

        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199
        • Size 170B
        • SHA256 5d75eca6cfb519f4b986c0e94bbf9e2da95248610a01d8270f56279ae844a1f2
        • MD5 SHA1 SHA512

        05DDC6AA91765AACACDB0A5F96DF8199

        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199
        • Size 170B
        • SHA256 4293f4170989ee3f838d751e5df18dcca232510378815eb6c9b29d1f2d072ac4
        • MD5 SHA1 SHA512

        05DDC6AA91765AACACDB0A5F96DF8199

        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199
        • Size 170B
        • SHA256 e5c46948fc05af1620235fb1edd7e32624a1488f1a4a41e2d78d244cb1a20c9b
        • MD5 SHA1 SHA512

        24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
        • Size 410B
        • SHA256 576cf6dc850d84c0df524c5c827f7b9f60aa97a8ec0245cc06843856217617af
        • MD5 SHA1 SHA512

        3C428B1A3E5F57D887EC4B864FAC5DCC

        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
        • Size 252B
        • SHA256 b8f9cefd661c7101a25e337efceac93bc8c630fd79abd3cb0b1772743961c03f
        • MD5 SHA1 SHA512

        94308059B57B3142E455B38A6EB92015

        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
        • Size 342B
        • SHA256 b16658e40c7242ebf7949caf47de7e832714227a396415f0c53c772e4dd60599
        • MD5 SHA1 SHA512

        94308059B57B3142E455B38A6EB92015

        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
        • Size 342B
        • SHA256 44109a656837d6f228f231d6168fe44366820784faca0f178c32d3c6d1d467c1
        • MD5 SHA1 SHA512

        94308059B57B3142E455B38A6EB92015

        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
        • Size 342B
        • SHA256 43524783512841367b556adb2199c9aeb69280641856fab51b51df2a219b99eb
        • MD5 SHA1 SHA512

        94308059B57B3142E455B38A6EB92015

        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
        • Size 342B
        • SHA256 1cda58be0084627c9e222ad1343ffac6d3369f7f3364e6ace48a5db90bd4bddf
        • MD5 SHA1 SHA512

        94308059B57B3142E455B38A6EB92015

        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
        • Size 342B
        • SHA256 72f8a3dbe87a18f5533ae339d873ef0426e63dba227a66e3d70105406874bb8a
        • MD5 SHA1 SHA512

        94308059B57B3142E455B38A6EB92015

        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
        • Size 342B
        • SHA256 b59bc85634dc8f4d9d569f399336730f8d487463c24ab83f3bcd9ced5102d62b
        • MD5 SHA1 SHA512

        94308059B57B3142E455B38A6EB92015

        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
        • Size 342B
        • SHA256 c4de4c06a6a5482052bd52e6639cbc7f362d8ff9f7ce12a6b919937401ae71ee
        • MD5 SHA1 SHA512

        94308059B57B3142E455B38A6EB92015

        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
        • Size 342B
        • SHA256 375acbc0868f53a4a820c7bdb003b6a7f0e7cc1b339da3374983bd40c2199fae
        • MD5 SHA1 SHA512

        94308059B57B3142E455B38A6EB92015

        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
        • Size 342B
        • SHA256 d6e637b0ea4d9df434a96a06958e5771144806eece4e930a91da52b3146df2ad
        • MD5 SHA1 SHA512

        94308059B57B3142E455B38A6EB92015

        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
        • Size 342B
        • SHA256 961822c380bcec84ed6bb9c75ad940955f525d722d0432dbad9f534a82a896b2
        • MD5 SHA1 SHA512

        94308059B57B3142E455B38A6EB92015

        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
        • Size 342B
        • SHA256 0a023cabe2e00332677e3851a83a6b20037678562e3a19c637fbe7d26a4dcdbb
        • MD5 SHA1 SHA512

        94308059B57B3142E455B38A6EB92015

        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
        • Size 342B
        • SHA256 7b92d46b40701ff9b9832e54f4213837ed33103d7369209b9a4b9c5d179dfbc5
        • MD5 SHA1 SHA512

        94308059B57B3142E455B38A6EB92015

        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
        • Size 342B
        • SHA256 33fe0b42feb373111ec7ad8d516cbe7edf6d06d1c8d598f19e663bcedbe26e32
        • MD5 SHA1 SHA512

        94308059B57B3142E455B38A6EB92015

        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
        • Size 342B
        • SHA256 41de7d3757df026da5ae2b489aacb9d7447a8ad8db99ca354738c34b8706b472
        • MD5 SHA1 SHA512

        94308059B57B3142E455B38A6EB92015

        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
        • Size 342B
        • SHA256 e1dae1d07822c428cbf3c8406b70cb9345cf414e114dc3ff637e161403b1b946
        • MD5 SHA1 SHA512

        94308059B57B3142E455B38A6EB92015

        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
        • Size 342B
        • SHA256 1606906d23a8f7d75795b83d31a23a9064d54c9242027dab6a288ec9913a7287
        • MD5 SHA1 SHA512

        94308059B57B3142E455B38A6EB92015

        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
        • Size 342B
        • SHA256 bcf3213bc2dcd725277089e7c1417b9cb4bf885e7b1512473badcd99bf58c9b0
        • MD5 SHA1 SHA512

        94308059B57B3142E455B38A6EB92015

        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
        • Size 342B
        • SHA256 2258909167fd35bfef195ac6997177a991f899455160c8fde8826a515f6ffd8d
        • MD5 SHA1 SHA512

        94308059B57B3142E455B38A6EB92015

        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
        • Size 342B
        • SHA256 1023e76f1edc143832dff8445c70c6338a84f98a772fdbd7e3a9fe96ffd423cb
        • MD5 SHA1 SHA512

        94308059B57B3142E455B38A6EB92015

        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
        • Size 342B
        • SHA256 22cc066e2cbd5c991c2fda169edc88214b3a81dae4cb4b32463008130ceb9b28
        • MD5 SHA1 SHA512

        94308059B57B3142E455B38A6EB92015

        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
        • Size 342B
        • SHA256 561ee5b1b52a4021c2e850a9fa05aa778bbc178428615aff5969a25bbacbbe68
        • MD5 SHA1 SHA512

        94308059B57B3142E455B38A6EB92015

        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
        • Size 342B
        • SHA256 4ddf1702a9e703693f7725bc535fcbfb526eae72ddff28323278aa001f0fa5c9
        • MD5 SHA1 SHA512

        94308059B57B3142E455B38A6EB92015

        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
        • Size 342B
        • SHA256 ae78517bf0bd299a33ebc7cf9bc27f72102266c59d44b2b856e8454162fa5bcd
        • MD5 SHA1 SHA512

        94308059B57B3142E455B38A6EB92015

        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
        • Size 342B
        • SHA256 b15e9aff7af7a306f772360d404de847554091fefc6ae2db93fb4296052cedfa
        • MD5 SHA1 SHA512

        94308059B57B3142E455B38A6EB92015

        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
        • Size 342B
        • SHA256 e42ae2cb0e305c5957584d5203bd77cb32d7edcccc9e7267fdb7dc20675fee27
        • MD5 SHA1 SHA512

        C02877841121CC45139CB51404116B25_D71A94740B0CED76EBD7AAE2374CBE8B

        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C02877841121CC45139CB51404116B25_D71A94740B0CED76EBD7AAE2374CBE8B
        • Size 406B
        • SHA256 1f6b750119aa9b9af0f5a053b1f44ff0aefff5ad70e018e17e1b0ce13d1478d5
        • MD5 SHA1 SHA512

        F0ACCF77CDCBFF39F6191887F6D2D357

        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
        • Size 242B
        • SHA256 6b8409bd7554e89545582a0ac958bccddce0139caa7c4ee7d966a6706dd66908
        • MD5 SHA1 SHA512

        www.youtube[1].xml

        • Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\RTF4E8C2\www.youtube[1].xml
        • Size 578B
        • SHA256 5643b459b6b2b544c87d400aedfcf9e36dcfec5fd0609392928ac18d0548dba9
        • MD5 SHA1 SHA512

        www.youtube[1].xml

        • Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\RTF4E8C2\www.youtube[1].xml
        • Size 578B
        • SHA256 6a898cf2b0046239534b35ee9b75b9170b6d2c46f128823c7a396a30be6ed7f5
        • MD5 SHA1 SHA512

        www.youtube[1].xml

        • Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\RTF4E8C2\www.youtube[1].xml
        • Size 578B
        • SHA256 9b77e757df94f1d54cfbf031abe4b86dbac2593c289a09b6e483d0c30e92013b
        • MD5 SHA1 SHA512

        www.youtube[1].xml

        • Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\RTF4E8C2\www.youtube[1].xml
        • Size 13B
        • SHA256 b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db
        • MD5 SHA1 SHA512

        www.youtube[1].xml

        • Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\RTF4E8C2\www.youtube[1].xml
        • Size 229B
        • SHA256 11cc3772e0141460c8cd2eb718da0c8d662b8d21d92005140558420ad7c76c70
        • MD5 SHA1 SHA512

        www.youtube[1].xml

        • Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\RTF4E8C2\www.youtube[1].xml
        • Size 15KB
        • SHA256 fcf41bd542f4258bf76a83dddbd2219d1d024126009536765885a8e76cba3614
        • MD5 SHA1 SHA512 SSDEEP

        www.youtube[1].xml

        • Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\RTF4E8C2\www.youtube[1].xml
        • Size 578B
        • SHA256 14a9d7881b4cb666be5dc332612f22248645b965a6fb9769db0b32dc36ddd47d
        • MD5 SHA1 SHA512

        www.youtube[1].xml

        • Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\RTF4E8C2\www.youtube[1].xml
        • Size 578B
        • SHA256 a0749638602ce90073b412454f72557522592330f57e7dfa24af1f3f1fae43db
        • MD5 SHA1 SHA512

        1380534674-postmessagerelay[1].js

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2UK8J8K8\1380534674-postmessagerelay[1].js
        • Size 10KB
        • SHA256 01a956fa0b3ea8cb90d7032608512bc289c4170bf92759352e40062d5be2946f
        • MD5 SHA1 SHA512 SSDEEP

        cb=gapi[3].js

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2UK8J8K8\cb=gapi[3].js
        • Size 67KB
        • SHA256 f65bf40e2f0ce993b54772f703f72d53f0fa925457346fa8ec2031879ffa91d1
        • MD5 SHA1 SHA512 SSDEEP

        analytics[1].js

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3H1FOMV1\analytics[1].js
        • Size 51KB
        • SHA256 de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
        • MD5 SHA1 SHA512 SSDEEP

        BAK0YLK7.htm

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HTBGGANG\BAK0YLK7.htm
        • Size 216KB
        • SHA256 c59748393a0bc078b7a18b737349b3d11ad1aac6b1de39ca996b46e23721f6e8
        • MD5 SHA1 SHA512 SSDEEP

        rpc_shindig_random[1].js

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\X761FPIN\rpc_shindig_random[1].js
        • Size 14KB
        • SHA256 f7067f1d01d9c60618becbe4df3d61778244108459226e2e8a818cfbc2c18ae6
        • MD5 SHA1 SHA512 SSDEEP

        Cab4F2.tmp

        • Path C:\Users\Admin\AppData\Local\Temp\Cab4F2.tmp
        • Size 70KB
        • SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
        • MD5 SHA1 SHA512 SSDEEP

        Tar591.tmp

        • Path C:\Users\Admin\AppData\Local\Temp\Tar591.tmp
        • Size 181KB
        • SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
        • MD5 SHA1 SHA512 SSDEEP