socgholish | b5768e0a7640b50a1a444c31d3d45c1779e5d2e84192756185225eed7a30e3e0

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
17-10-2024 02:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b5768e0a7640b50a1a444c31d3d45c1779e5d2e84192756185225eed7a30e3e0N.html
Size

48KB
MD5

e30e12fe1b5b9d841f8fbe8c4cd93e30
SHA1

0fc8c566bb4a2e79431c50cbc1f2478cbe134f3a
SHA256

b5768e0a7640b50a1a444c31d3d45c1779e5d2e84192756185225eed7a30e3e0
SHA512

49a05bc040aedc861dff36b359a8ad1008b33fe8c14d53a1bda55a381a0909223a7272291bff249553410253cbcd3479722c17844186e9c9b519f44c71c3ac98
SSDEEP

768:BX8Jrpje0DnLmCQHNeTCINGUumH6D1S70Hss9EVg1zDPmgq:Bipje0tIqGUumHBmssaVg1g

Score

10^/10

socgholish discovery downloader

Malware Config

Signatures

SocGholish
SocGholish is a JavaScript payload that downloads other malware.
downloader socgholish

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "435293272"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DABB07D1-8C2D-11EF-B8EC-E699F793024F} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2888	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2364	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2364	iexplore.exe
2364	iexplore.exe
2888	IEXPLORE.EXE
2888	IEXPLORE.EXE
2888	IEXPLORE.EXE
2888	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2364 wrote to memory of 2888	2364	iexplore.exe	31
PID 2364 wrote to memory of 2888	2364	iexplore.exe	31
PID 2364 wrote to memory of 2888	2364	iexplore.exe	31
PID 2364 wrote to memory of 2888	2364	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b5768e0a7640b50a1a444c31d3d45c1779e5d2e84192756185225eed7a30e3e0N.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2364 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
46dc893487c2fd23c0372754564f2f55

SHA1
09644f696063f47a5bbf5d3a9aeaadb47f16d9d5

SHA256
172c157d41e074e49b472dec6c3c8560326c9ebb38e246b05aa601d4104b4933

SHA512
ea0c521a3231a852ea8ccd2f21d5b6e88bbb0b611d7199f16fa475fa10779f9b5b182e6b3f858213ca0f1cdc1ec28b37d88603d1d13d8f024de1039f3d5f6b75

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
88e02a9f06bf6f6ab1f2e22845e66cbb

SHA1
7c779134ac2e29daba04c59f4454f67a0ba2824a

SHA256
894aebad8aca3f11a2166cc66ee437aae28f5228ed275708763249d685db3271

SHA512
6fbae842775ee04caa2e5b91f3907880a1d7ec56d6a54aba07423c34b063e78db0094dc8b42221ca95111cdb0776490dfcfbce1ef5d62cd66085a26de0de7349

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5e62f2462a0678eeac63df66bc71a9c2

SHA1
27bb75e4662865390b1b7a2fe6ffe95e370b4dcf

SHA256
78c0788a936410d4a9ddca2a9b2acfb60bde7846deb073b4bdd14b91c63d8f10

SHA512
24a836f55cdf553fb5db550ab46a1253895be25464ffb6a6d899cbd8b26ba4678dd3fb6c5a59975d7ab3c8c419bac335c762281390ac2ab821d919ccd46b2743

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4e20c647e833d0a29a93a3f9688a16c9

SHA1
c07075fe8724ae2f3a1ea2370e731fe09585f1f7

SHA256
62591247c7977037f67f8c5adf9fe6f01b5b3a9196ce77f5236a4b08ea8e5291

SHA512
ed9ff62f49baebc518496ddc9a3e09071927f1f535daa7ad703f001f35666ea5a8bc4a75e8ce1bf48e1d6c46050c84db36d54b4df3557090ad0b8c4aee3d8681

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
96e776afb19e047404064ca6c03a4524

SHA1
a93238487ef788839c4ea5433441e984a1a7ae44

SHA256
89680ded59dd52bfd937b909f3b39c923ed36b6fc1e046e36087690bd35b8713

SHA512
3b307c79d4f3ee393b9688fe252079a4e8bb77e6ecca72836d7727a7c2d209d3990c3b84057af23696b5858778d5146bc28cf9f0777598c5a5b66ed95f59abdf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
02cf98e26b6142a7a15fa0fa742e76e9

SHA1
0fe2f5630c66fe3b03b8186c4c3d9055df044761

SHA256
544aa6fe119c6ce71164b97fe70d6365aa06eea02fd30f35f25c91622ed56930

SHA512
453e8c08e5bf434927cef40affcf7605ad606549546e31a03c1cd00f1374193c1b5941b271834febca8e25147736a1910f0c303706d20e8e3b28292114c0f7d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
195915324323aaf9757f870e95e31bab

SHA1
d1c729311dd28f3cdd4c7fc92dbe3bbbe3182640

SHA256
9046abb564b207ce7ce522012a40f5c297e5cdd8f9f0b3204440d771e3944262

SHA512
e75ba6cc8b2355710e81c27b687571a23fae84db4e1e921ebe300776ff54365482668640843acdc497daecc22e989c121c0ea30208dfe185d11b072aa07e7193

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
43b3710614b1109c35d0b0650c5135b4

SHA1
79cea1727244c29662854c26ae942194eb000b85

SHA256
6d863c36018d5f3d3d2d52626bfff57a580310bfdbc94fd28d5ea0b7434c2e5c

SHA512
caac86a5a517b82b713cbdd35b029cd47280f4264e6d6a4a470aeb534da5f0c15526b55d945e22f2db9a5a4cd7ba808c4f9731db1a29a0b92b75d4151c3c2d4a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
84b7993037a6c08c36b4406124b803e2

SHA1
d64f44c30009ff903d53f8023a5df7afff04d1a9

SHA256
1e03f36ef66c50cf4ca7f60d7b8e7d3f677e9f0267996408a8f3b4c8bee951ef

SHA512
1e306fd1b1bac499457da919ae2f995372674c24b6552fc1512668729238c4e978fc01ae97e48b88d0a12233b3c6bfc600936867fcc03256d1633adc3454d8a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f757a5b0200b3f47e56e9b50d2e8a2f5

SHA1
38bc744c5faf6fd98df7acfcecae8ae64f17c97e

SHA256
9a28c10e38e8a3e0edb96dea413eafa883a2b2fe6ae89344e27e2fcfdd201de6

SHA512
8031da5af5518e68cb893cfa4c7666c58fa66f06a1c09bf8b45cc5395f83d3a3866587f80f51840efc7c5ec249e5bc97df78501986a45dd845f1e7cd1758afc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2c7e7499b888f085d60471111c3956ab

SHA1
d5815d3893aff646fdb12542cb029ecb020ba8d4

SHA256
b7d75ba7d9d10f369a913ecadaa28501ee43cd6ea95bf899a48a6132bdc1e664

SHA512
c77fd6b9f91de0baccb3995783c72674e7e920513e345fab892a2c25f98da64205a36095ecfb38da0f97fc00af4a96940953be909354a826bcf8676f000c4fa6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
84df5bb4b663946d343c12171fef5316

SHA1
d525d526c6f4760444d35b6788d7f38ccafee3c9

SHA256
2055dafcfc59c6064f16ec24d92edd132eb9d630852fd39a72f1d5cb61dd475d

SHA512
62ba43803dc5fd473629690bb35830c2c687d1e6ff98c698cd7b628552f4de5e567b026a1bda7cbe76669925e39e9874fc16ce733e208492af56a70fe3fbd494

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
344a394cc215fe198ac35456eb3699d5

SHA1
f0178f1543fa6508f6c4e2e40e8875c39a839989

SHA256
920f46690d1030959c26b67716f58658a97c7655e896e011ad528148a9c4679f

SHA512
060e5a6e006109a9a8dfacc7829b3ef104ce9fd5eff36ed6c38764e2c81237e66cf64669f59d9da88c08052f797075486e87026fa68ab060b3b00f99b64e39a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EB0KZ1Y4\cb=gapi[1].js

Filesize
175KB

MD5
edb4780eb07f053a8971c18b2085bbdb

SHA1
0ca7926399368db5b1dac90872686b47b38de67d

SHA256
679d4b6ca14337ff5c8fae42ef869a5466a71df816e8d304e7bcc7adb1400b4c

SHA512
a8ea8dfa79fe232fdcecdd0d0e2388462468816e7faad38d13acef94fe16b3620f0e2f3debd716834aec32eeab4ca00a53b2f468b57f0cb7ebce969d2049d5cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EB0KZ1Y4\cookienotice[1].js

Filesize
6KB

MD5
a705132a2174f88e196ec3610d68faa8

SHA1
3bad57a48d973a678fec600d45933010f6edc659

SHA256
068ffe90977f2b5b2dc2ef18572166e85281bd0ecb31c4902464b23db54d2568

SHA512
e947d33e0e9c5e6516f05e0ea696406e4e09b458f85021bc3a217071ae14879b2251e65aec5d1935ca9af2433d023356298321564e1a41119d41be7c2b2d36d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WUBCGJ0A\1926661341-widgets[1].js

Filesize
142KB

MD5
f56209138611a04fe9db36b41100455d

SHA1
c36e2fe31ac9d38fd7d9782af06505dfba960ae1

SHA256
742b8b9d2415d0bbb44e403ea30c4714863fb32eaa4314b5e62b477cdbf40a56

SHA512
776502ca4f23db563a17015b89263a7c497fb1c217183d543f1562bdd49cd1b5b374108c338a86587571368403e75a8da4f0853aa69fff3917916fdab9ab2d7d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WUBCGJ0A\55013136-widget_css_bundle[1].css

Filesize
29KB

MD5
e3f09df1bc175f411d1ec3dfb5afb17b

SHA1
3994ec3efe3c2447e7bbfdd97bb7e190dd1658f9

SHA256
1a2eca9e492e3a21e02dd77ad44d7af45c4091d35ede79e948b7a3f23e5b3617

SHA512
16164d66d452d7d343b1902fe5b864ffdee42811ee90952cbfe9efa9847c58c0403f944c8e29db2bc2384ccd516b629cb8765e5e51de37da6efd75962cf82530

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZOGPI1N2\platform[1].js

Filesize
62KB

MD5
b45bba9c7a008e20767595f0983c2df9

SHA1
398155dff202464046fd76d52a5cfaa5f8fdaa33

SHA256
0fe442c392ba79a12acfdac7466b61109511238a1f5590263652c9aa6a1c8d37

SHA512
0eaab88d4d73d735bcb49cf5e971a08e50845cd844fb8974869dac9e7637200f9c6f5c361fd411c34c1c531dba50bae30c025fb547868e43acaff53746d1b205

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabDD8.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE48.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit