socgholish | 751536cd9d5b189daa4a8d85feb8ec9fab29449378dd4dc4b8336ed2d93bd0d9

Analysis

max time kernel
141s
max time network
142s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
29/09/2024, 11:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fe7a5e5eb25c53af034820531deb13b6_JaffaCakes118.html
Size

78KB
MD5

fe7a5e5eb25c53af034820531deb13b6
SHA1

8859cfdf93adc1822b170fb089d9e067185df097
SHA256

751536cd9d5b189daa4a8d85feb8ec9fab29449378dd4dc4b8336ed2d93bd0d9
SHA512

3e493924fb51a25b9e9be88e659f88bedc1c95547c939c98326aecfe63a9e1e4b9e6010554b73a25543ce2862129c9bf6c486262c139042d000565ec8813b7bd
SSDEEP

1536:5CnlA3M5uQEJjpEYlRymtaXd02l+lqhBGOCzr2kYNqwLqi93AkQ:52oy642PaCzKBqwLNKj

Score

10^/10

socgholish discovery downloader

Malware Config

Signatures

SocGholish
SocGholish is a JavaScript payload that downloads other malware.
downloader socgholish

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b3e8f15f634dfc43bfa5c3a2648d88c4000000000200000000001066000000010000200000006415b10eaea84c3bf0eec8945a5561858694b73942ada351c6eb525e61819337000000000e800000000200002000000061f760f048de854c5a3f708c5925b53b87840bfb7d2b28f43a04cab24b9d8bfc90000000ac21da25fa89e1cea23d604b53876c0eff1ba8c37334998cb1954ea31ce51082431c0da87a99c4662f448f3e397c65ebbe750bcc25e1e341abad2843bf3b7981a1793970507febc43e706964fdc06a8c62da97def1d34f4b9dc0ec6c1443db27601b380b9bb76c9bb57e8135d5463dd28e68b5965a38112b282817d88297efeed89de0a1f086ef0e18742bf741b5706d4000000038d1fbd738eff57b7687365d70388baf5145ca8ae98b003f6c84c4430aad80e3e265518c6e9e64395c77e2479936c911d944d3bec3e0853ba1e2acccdd9fe6c8	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b3e8f15f634dfc43bfa5c3a2648d88c40000000002000000000010660000000100002000000088a7ed369d64dd472ff3d9cbad4df368e8bc0ec177fe75189114585993610039000000000e8000000002000020000000c1c33d49442cee167f4a94d44ec4a93356c729f7e5d1ecffec199adcec03ae192000000060cb9857a6a6b92764b5a1afcb90c10d8b6001cde63d12f93b4e23949239de9440000000868733a6500b92a7524e542c5679524ac084c3da9d120a2229128331aaedf9c21ccc0305256a6c4d41fde98107e238e8e11e356b38386b636f2b997aabd5b5a3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1F8B4CD1-7E5A-11EF-AB7C-F2BBDB1F0DCB} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 8092abff6612db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433772970"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2512	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2512	iexplore.exe
2512	iexplore.exe
2316	IEXPLORE.EXE
2316	IEXPLORE.EXE
2316	IEXPLORE.EXE
2316	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 2316	2512	iexplore.exe	30
PID 2512 wrote to memory of 2316	2512	iexplore.exe	30
PID 2512 wrote to memory of 2316	2512	iexplore.exe	30
PID 2512 wrote to memory of 2316	2512	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fe7a5e5eb25c53af034820531deb13b6_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2512 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\05DDC6AA91765AACACDB0A5F96DF8199

Filesize
854B

MD5
e935bc5762068caf3e24a2683b1b8a88

SHA1
82b70eb774c0756837fe8d7acbfeec05ecbf5463

SHA256
a8accfcfeb51bd73df23b91f4d89ff1a9eb7438ef5b12e8afda1a6ff1769e89d

SHA512
bed4f6f5357b37662623f1f8afed1a3ebf3810630b2206a0292052a2e754af9dcfe34ee15c289e3d797a8f33330e47c14cbefbc702f74028557ace29bf855f9e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
980fcc8fab5719c40429a8ddc3704f74

SHA1
df5164c12e82cac70b6c16931409983c557f4aa4

SHA256
bad308d67bb02f56e8dc0b49340229e93647ba796584ab86e4c0259801e18324

SHA512
bc8e04eda45fe50818a6e260b567d1907956bc0b092fb50e7ab16cffe0c3f23a6e17c584dc7536cabbd81707a73b5009becb9dd3fe9a7a6dc7ab68b03b62eae3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199

Filesize
170B

MD5
fa26b864bae968102dbceb779ede9632

SHA1
15997c9b8286fffffcde47840af11ee7ed5ac06e

SHA256
7ac35b66d3367e185dcc9a1fc4ec3b7f510cf3c3c48d21fd0bb30353ef7aaa8e

SHA512
4e899d5b41a9cacc012499ae4cc7825ddd4d6a06b5f6a8fd08056c7193db49aff13da556b55e7b7a3a720d43831e4531652dd5ca4d6b6523aaebefe1fff812f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
dd21419d30a39c08c0e34f40785cc197

SHA1
105d457ca902898379e684f8fa903a44cbe80e50

SHA256
7e34da081bd01dc70a492320ce1535e0b15a37b812a25f2e095366bea8e1e32e

SHA512
1855f0915f8de94eed79b8c154d2d61c61d64f12afa7dc88b82cd86e707bd023b1301f318cd0e7459fe45d1ac3c3bb6ce05205c4b668a7e5fa781f2918c681d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
199d0854a1a6a028e8ce988db2e82226

SHA1
c351fb4ae77fc8b9be90d6c56e3c15dbcecfa5e0

SHA256
e4036a9ee32050694ae775a128435e26fb451686c8fd83058090461cf3bec303

SHA512
a18add9b31ba2c1a0e799108a4b84e938e5a1636c842458faa3dbbf10bf4b4eb83686914722a63e2bbbbe0e9347a69db2b20a357bde41a086a0460c2b7f86e99

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f45858e1ec888b057cfd1872528f7cbd

SHA1
447909df0f64a4b0a73b72ecc3eae6a165873997

SHA256
14d0784d96c7a5c53198f34cfd949b4ca802b4163bb9e8fd77efa5f1ef78fbb7

SHA512
cc7e64d05d145508c269ed2f9a0277d930a39b843f36ec9eac0780d31d77dd99fbff13e6ae91eb922a098f048ed4dac928e12dfc0ddddff94922e3ae94749163

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9fc5cc76c97de6e77ed5bb1d82d8e069

SHA1
cee3af490d69af12174974cf7861fe999b0ac557

SHA256
d81e264f5f345928038091d7b2c40e1fa2cb59c529ccf8528d3c0a9e4b0f7591

SHA512
c4a7a1d346d71472afc748c0887edc8007d766f76149d4f11d6c8fe9eeaa4be8ef24022a9d0c2597347add949406b42ffdbf196599b0a7d112cc07aeeb8d9bf7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5f6083899bccec537586cb6081163358

SHA1
25499d6d01eb6e0ec3fdc28164919b0d4a489b5a

SHA256
48e05a430688cf5db341be0f06cc181720b45e92af474f2f03856ee70216ad52

SHA512
810c755ffb23c332379ac6fccf596ba6f2a8e9ea28d7bce465b385913cfc0a969dbed4771ababe683c937fbcb80399f050937543f70079db8fdddafc9c886d91

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6570a401626317b8fe9eb689808bfa08

SHA1
3fb83dae531beed1df924719fa0fd7f11462cc38

SHA256
1ad3cbc85287d068e264554baaaa8bff88e270072d69b44354b6fa828b68c926

SHA512
b28077c69bd64ea79d04d728fce87afc5ed24c61b2581ae3100dcb0eb2e776c4964bc33eb71088fd0d36ab26ff6b5c378a284e8a8c2555a6e2392f7d4f60b1c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4c2750e6798934a0a2d419989bbe4d56

SHA1
77761869c48317bdfe5d4ae103cd8d75b360f373

SHA256
6ce742e999915968df698304be8e7a2255d9830b09034314d8106038b17624b2

SHA512
1866dd0e5058761efed4e8573ac8a43ec09525548815902e295563201fec10a1c9bb9eda40271754a9917e6b54d4614c3a06a0983919102d55eb997324ef1dd7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7f49a8587f4ca6914cd59e469eb94304

SHA1
6a49b648844bafbd2ed546e04f2450ad4a0983ca

SHA256
5ed95339ece6e54be2687b065cef38a0b207c5706f24578031b9f302242de61d

SHA512
e3add017eb72ab5834e4d5b3c0747548df0237b54b3ecb238fc5136d68f285eab8b4d26e4b6c72298676a0421678112d61a4312dd9f2f703a6bcfb21a447d6bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
45460cd30ad62bfd2ac585cbfd95970b

SHA1
65d49e35a3041a2aaaceacdab58fcf3280b1e9c5

SHA256
417e7877e916b25979d5c8fa38828002c43fc7bbbe4069e532d1a62f68802d52

SHA512
aeb49eee255604167894d6c2a7d5915b77ba2c3c1f2ca590a8435a468a4dbc0100a9abce52ed988065c41631bbf0ec5035423d4afff9a1405b9ede2b862ba43e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ec21a34056d4f4273a61c4913ece44b2

SHA1
6ff5faebb068639f2791d9bb7ab236d457c582cd

SHA256
4cab89f410cbd4670564ce72700203d06de2284084c89f049487b0cf55eab810

SHA512
8f47b066735d3141406f09bcfcfe76235936ce0aa5258a7667f885bc7753c82d1f6c42a6fc7097ba939b73095ea7079b6ce413d25de34645dbc5d37dd76b68ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9UR26M8S\cb=gapi[1].js

Filesize
66KB

MD5
aa012028297a26c039c37ab25a4bd17a

SHA1
25f23d01b5f580c00778e1c010225e5b8c73b66c

SHA256
55cd2316edf7159b623e4ec2c9e3a334027c01e2d1cc386f833ebcd35ed87b38

SHA512
d346eb082674fc26d562da9a12f36ad2cc7db1f1b35c891a8734284cf1bd052a967137c1281982070688b2bb2e06c7f4967d1c9397311a31a11a8560b9c45fd5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9UR26M8S\rpc_shindig_random[1].js

Filesize
14KB

MD5
e691b2e17de9ec018eca758518bf5dc8

SHA1
3238d543acf53b803dfbd260405fa558717daaff

SHA256
438d41bec769ff386a2c1555b6bf9105362f67dc3e711c81c6092ee7fbf6ad2e

SHA512
5589a5cb408ee8e0fd473de24224ba8fa1453eba5df6e591570810f992160d4f3e8f60f8ba74d9994861759321f5bfe0c4a608636913a8407b5184008457afc8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\AS91FDNI\2254111616-postmessagerelay[1].js

Filesize
10KB

MD5
c264799bac4a96a4cd63eb09f0476a74

SHA1
d8a1077bf625dac9611a37bfb4e6c0cd07978f4c

SHA256
17dce4003e6a3d958bb8307bffa9c195694881f549943a7bdb2769b082f9326d

SHA512
6acd83dfd3db93f1f999d524b8828b64c8c0731567c3c0b8a77c6ddcf03d0e74ee20d23171e6ceac0c9f099dce03f8e5d68e78c374da2c055973f6ac2db4e4f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabCED5.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarCEF8.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit