socgholish | 4bd8caaaa32f2ef0fdace2a5b752ccedb39fb23310adb1991bf1201f5287b4d1

Analysis

max time kernel
145s
max time network
152s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
17-10-2024 16:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

529151ebbc84056ac12a80f77bfc9255_JaffaCakes118.html
Size

135KB
MD5

529151ebbc84056ac12a80f77bfc9255
SHA1

a6cd42c2690cafabed64ee7dd7c89c8dbf36ac70
SHA256

4bd8caaaa32f2ef0fdace2a5b752ccedb39fb23310adb1991bf1201f5287b4d1
SHA512

306d5b02cc0e09449c6b079ad275819c0e9e63e5a4c45d37ac842f7c3af7bb90f11f7ab0458349e472ba86101bf22fd1194f0781194ccf641f1e34c125cc9910
SSDEEP

768:2bk1ATx+Bw24Tp7VDOwTXT3ipt+COC0/gAtnakyhYkmQEDCheNQGOXB9kCjclp0h:29HDO6COBgNky9Z5jclpXcDOStXGK

Score

10^/10

socgholish discovery downloader

Malware Config

Signatures

SocGholish
SocGholish is a JavaScript payload that downloads other malware.
downloader socgholish

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f067de62af20db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b3e8f15f634dfc43bfa5c3a2648d88c40000000002000000000010660000000100002000000067023337ed76e2e9182a963116b902dafea3910d2aef8a0130d3f95754bb95bb000000000e8000000002000020000000ef611e5ede76eb019862d62ca29beab03bbd3301b9406e3b41dd7b5dc5f6bcea9000000072443fdc543232945c2d3aed201b483bb07ac76da0481f2a05e5f91c356f64364993f1ce3286de1f87a06448e1f45ffc740415393fb8da82be6cb6f025dea5c57b68e3bed073c383eeccef861522d438112d6c03d1559bc311515dea1dd0c270c34f3de84c8d81d2e7ff2db9bc64878d910f4de25334d6632e8352eb7ec51e7b419522d38b4aac7fb303aa2a5e8db7bb400000005831657c6f69f707247c0c041384287c845715417138c0da928b5bd38b49118b3b410457322674644ca9f3d7bed59503941e60670a1e0890e8e37e7f7d85fa1e	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8DC63331-8CA2-11EF-BE65-4E0B11BE40FD} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b3e8f15f634dfc43bfa5c3a2648d88c40000000002000000000010660000000100002000000071ffc8e7b9d948bfffbbde01ff1ab7d8388f7b4996b57883d5b1a70fa6d6d5a6000000000e8000000002000020000000e0bed31c6732731266a85c2057f7ceb017005e5fadf3b093cc069b8b4ec226902000000097816dd838c9550a8c71682c6ee801b03f7cc176460c8a7ee191e772486502e540000000a95a934b7f796194f38f792b9a156c5ec07947b0e1606b38a0bd58a343199acd3aea64132cbd9b17bd7eea90b54adf03339063aa78bdc1520ec465f1fe6fdf0b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "435343393"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2820	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2820	iexplore.exe
2820	iexplore.exe
2688	IEXPLORE.EXE
2688	IEXPLORE.EXE
2688	IEXPLORE.EXE
2688	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2820 wrote to memory of 2688	2820	iexplore.exe	30
PID 2820 wrote to memory of 2688	2820	iexplore.exe	30
PID 2820 wrote to memory of 2688	2820	iexplore.exe	30
PID 2820 wrote to memory of 2688	2820	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\529151ebbc84056ac12a80f77bfc9255_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2820
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2820 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
bebe3e752ffad04eef367255422a9b8e

SHA1
e7843317cc5c628d90fa9272f0f5830d5f10413c

SHA256
c5e2789e535102c79956085ab651a1a7e0c07eaafdc6b83c84da92c33769871f

SHA512
2ca4f6b6221df216883738e8978af1c2b80a0133854210e48e8d934307ae34f26980c5f9bebb8f8ef5021694f1047419e9a1b64c67a33c65fca544f3ee3020da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4568fe43251e39be8f4ec96c56b857a5

SHA1
630ef88f1b5dc0c49a96f4766c4cd42884a009a1

SHA256
66ca63cee22ed4044c2ce837f913f7a3ebb773ce71e42cd254955d5b1a672e28

SHA512
e5362d4438f21f18ae4c46b12ce5f8e9bb1521cec9bb03e4bdb98283ffe298795468460676d187c45ae7f3bbe97709b9933e38fa2f52487fe38cb5cacb702014

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3bd6a49175a85de55f26656120edb5f0

SHA1
f1cd46252ada5258080c0a4343a2f2e222fb5bb7

SHA256
b7edd4ffb8f3785145bfeafc438ccbb4b0690dbabd244daf8100aaa63361a695

SHA512
2d3d2c4066d1379d3746a7167cfe78b5865e9d12cf1d8a0157bf2d5a817bf9f713af9aded134b9d7e1844100da8659edf7667c1ed9df2b1c30de24e82f6e6d0f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
33839d439b8d065ea74385019617b971

SHA1
7774f6372b0852cc549ad161016916a0ad98243e

SHA256
2fb17eeb32dd519406c4b9ba07b369ca32618886fa10655db2967caadbac6d95

SHA512
5fb582874077c41d0800e763c535490c723b29b85e0d07d4505d29f0e2c1c9549b03da50abde982d61c8b90d793c888792f111d9f164f2b86bade1e52f287ae7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f70381d81270c64413c0ae3cd3b01036

SHA1
25207ab7568cb8bf0b2711a4b7057b39a1d0b79c

SHA256
c766b9d9b606639d7f4770a3ee5f00136966c7d5f3c314c51e3fd9e25fe33fca

SHA512
df8f119b7073160623cede21294c5f5645eef5f3f56fcba75d5357304788f01019cc49bfaaba4f335063af9ddb5275f8f4698d99a1c66323a472dc8e3b6df805

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ebca216b8362499e893f31e2632e17d1

SHA1
97462a206c23be13d246ae76df8db8d1fe5ad7d4

SHA256
47e6eda301f6839ee5375b283315ceb977e03c5e9db54a4add29e4e75f36de61

SHA512
a54bcbc72e378c4ded66b2141736086615c5a41429f2d72dc7da4fa3e4d66cae86b84fc60111bea335b7c8a6f38573d70afdce892cba372eaf0063937b363f1f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5a87315c7294f4e60089df6087f569b3

SHA1
00942f46c7fd7671b75aa9da63d5b66c4c4e3a3a

SHA256
ef088cdc9f9ae32e55d7ac438e586050716a957f0df1964a041863efbc183909

SHA512
e73c47c7662c6363eebb1cd653a5e012c9691ed7eaf8a5b756255cf1bec665688e3ad38225f521cfd5c04cb4a7fe2368470ee68cec4761c2eec81f2e7faa9adc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d706ac4438580b9aff072a95b5c57672

SHA1
b68a165ecb32a8672ffcd6acb2c0c828d770411a

SHA256
b838854fe5af5eff02c19151a9b8067f5c96e5a6870442f0836f12aa818351d7

SHA512
8f4579b45beb9a751342632d268df7fad0dbf5d4b7f4d60b46873f32d0e5f6bc54b3f900f2189b6f30ddeb08b9f9f8105a1498e15cf78ee027b6f11d089abb4f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
76e127494150973e75f60393902aa27d

SHA1
896230c352115816a65eb6215c854b4763783626

SHA256
796a899f62c47c9f4e8d7d3ff40fb5df426ffb2be1225278a60dbfb3cb9437eb

SHA512
7ea443adb1a7385dc40d042c64f48fb8afe495d0c71d449f18e09cd52acf423e2bf46f1b69f2ba3727eba92f343677aecb1a0eb7370a4e13b578ed14f17b8c91

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c5c672e742af006c867bcd758bb51230

SHA1
7c84a20eb65d4307193b3a28516f940a5f3d68bc

SHA256
cee212cd2c03ef92e49ed7bd45187944fe26ed1b21e20dec3a667fb417b05e60

SHA512
9a4a02b427175ff7e8b3f156017b0b7a1a1ae92a1e980d958e5ea1ef3692021197790a88f33859e2aa1739ecd903b8682147f957ff10bdf02b2d42368324d77d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f3c5aded77b59151443cb99e48d7de39

SHA1
d950f31ace54f58d9c90d45fe4f6c1bbb25519c0

SHA256
cb36793a97d8a7e35d065a6d930f0a53035f7c0e8c3e1c9fd51203921102a533

SHA512
aae6c1c56d021480a0f17f2ca5ec83742de2e342ec23979174a4ef1c9443952ca3137fa87f837c7f5465ed63ad0da6bccaf9ef5a39828186a00f0e80f7a0581e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d8d9ff503e9a1a9fb4ca4b7adef45c92

SHA1
e712180033379ec2da24c1c7bd646b1e39117467

SHA256
f89d0ad8ed209e2f8208eb2cb01ddade2634bd93d8789103f40e57a9eeed3b21

SHA512
093198430302c189fbda095e80fe8a05d3d19d6a498ea0c9dbedc20306dd460113bf73171a046ea05d27a4529e410f5edd2aa8b9c45fc805b03d716ec5adb34c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
bb18ccdf9c7401ecb59158ccc2a617a7

SHA1
66161d4c2e46bf778a5f6c362ef2c99507cedbf4

SHA256
3ed873257bfbd6017e111e78c6ff4ad6fb0ffbc0942f8d8536751f0476faa3ef

SHA512
3bf9ec325dcb1e0fd21ad5298031e91065e24e41d4aa6ad038243531b8b29fc2a4df9969d1d75530a32ec41d898bab66a722d1da70f31cb12bc26f9f2003e8af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
90c0f5ea0a447be068c5f8fc9b95bf5d

SHA1
65c77a591b1a6d517f3d33740c6408b53ea80b49

SHA256
c1141d7d80bf429baf4beca46ad15f8141ca9114e164ebaba7cacb348de3ca9d

SHA512
77f1b9f750916a74d8b96f9ca30c0449b89a971694fa56b37fceeeed554ddaf2822fecdd8a5f0ade3f9a90ac041b3abee14bf58f9413ddbda347c06afb87e334

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab77E0.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar77E2.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit