socgholish | bde58205d9afeaecf5fdca40548600dbc3fb0df666efa4eb472d0028d5a26dd9

Analysis

max time kernel
142s
max time network
150s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19-10-2024 02:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5a5fbc4d5ef99fb28287e3ab6397948e_JaffaCakes118.html
Size

73KB
MD5

5a5fbc4d5ef99fb28287e3ab6397948e
SHA1

57a51d674392f40223d225d8995219ef931f24b8
SHA256

bde58205d9afeaecf5fdca40548600dbc3fb0df666efa4eb472d0028d5a26dd9
SHA512

9abbd9de12f4b4756a0d3a210545b0562a7b379d7f50c0b79a0b0ac32999c80136410456f462b58c5c77fc86980c3a64026bb65d1e5c899fc7585b3a4855c796
SSDEEP

1536:fnlWVOZOUkf43jprQOCG6eMXgJ268GFxgxz/jIeILOrEo+Y+ujNT5VsNaZHyb:pOUk439roG6PXgJ268xz/jIeILOrEoZm

Score

10^/10

socgholish discovery downloader

Malware Config

Signatures

SocGholish
SocGholish is a JavaScript payload that downloads other malware.
downloader socgholish

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
96	sites.google.com
85	sites.google.com
95	sites.google.com

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "435466209"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{80A3FA11-8DC0-11EF-80CF-C28ADB222BBA} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2332	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2316	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2316	iexplore.exe
2316	iexplore.exe
2332	IEXPLORE.EXE
2332	IEXPLORE.EXE
2332	IEXPLORE.EXE
2332	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2316 wrote to memory of 2332	2316	iexplore.exe	31
PID 2316 wrote to memory of 2332	2316	iexplore.exe	31
PID 2316 wrote to memory of 2332	2316	iexplore.exe	31
PID 2316 wrote to memory of 2332	2316	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5a5fbc4d5ef99fb28287e3ab6397948e_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2316
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2316 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2332

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
79a297aba51ce1ac65a79efb45a536f7

SHA1
eecef30668373c1d18e76612d51077026564a75a

SHA256
d946b252c5cd54fafef13de4679d296f27571db2e36eb8b3d52eec9734f4bbb4

SHA512
4f53a9ab79178db137682fc6a5f1a516c47759da9708b4d4a2e3bf244eadec8006fd6843628a9b299943f21b302415de5ac055c501b926b110cd731292034b61

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12

Filesize
174B

MD5
8d0b6b3a098ff64565f533b113c4a842

SHA1
7b5c95e987618d69728fb3f0d292b13f45e0ae93

SHA256
695fe6222b33de9b1e681eaf7c479fc86b63f1b1c2516b75bf826b2bb18b638d

SHA512
90264d88d3c7aa23b892e1fe9616aab1c3a2a4cf60a01864333e67272674a40968c784cff898e550bb712f2e13729341d4e7b852de490d8a0926423de2eb4f58

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
86404bd6ee4b1a10b0c503c3a8adc101

SHA1
0466480f6614f990a167794a38eac506e34a0077

SHA256
170e13d348c4af47145f66d0caddf1bc9317110d7d5d9117d187713a0824f927

SHA512
eb3811692451367681f4ce7d6dc421053900647a25210b220bf2fc6e5733609c7c70ecb371289a9f9318a6064a854f77cdab98e6b3df4356fe4888cf5cabb2ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0e5af462325949cea4235827517dc693

SHA1
e8ee5256591897661db2612ac551a096eb3b9c8a

SHA256
ceb420e1a7a13a48f28ee7311f50962f839c8e4b521191df038d72d77477200e

SHA512
83ec436ea64403de8c2f4c6818e8179de8d68e0b8f328fc66ce7521bcca03578214ac9f49aebec6130547d0c50bb446d8e50ce106c2153cb5af88a7c4eff72ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
756a82c50d3df1aeb937772858f28ebc

SHA1
0f726f1fb23e2bba8c3a0f0ca1fa6e0ac4a06ff6

SHA256
f57f45e89a0d20a1bdcb62024205793c41ad79491dc14e285a2dbf494213cb28

SHA512
7ce03a5548f0498a0b2fd8bc77ac9859428d0564cc29189876b2c172e1a96a6455bca1cd3ef8d4e4184a016da79e157d23da9de64c175a46b3cc77f742f69616

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
039aa40816a7b399621a36ac1e5edc7c

SHA1
183730c68cebcd6744d5aa2726c6d824c08031b4

SHA256
9610b127cd5c073cf861a4b6773948c7bc1040104e40235a5518e5abd7dfbba9

SHA512
cd98bb5e9183bddb12eba71e120aa90f6f95082206294e266a467913a176badb2e81316ee0e1db05b39da800e40652a05e70c5b8b5858c3bc0bf60124e3252af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
402b31aa679dfc388c08a4be35903f8c

SHA1
b6811f9358a73364849b7f08f83b34d8c6c953d8

SHA256
38c388f457295298502d7bfa48c2aab738efdad86e1b5a98ab24b2549424482c

SHA512
4161a091589568ba14b5e1fd8d1701a55c2cf0f61217ad5f52d8fd985140b3d4960de023a52be6bcd52fd812456840a06e7ddc139aef127c6bb276f2860ec4e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fdc3a774868b0f86936b33519cdb0047

SHA1
03d6a413127d774e29e3d3d7bac5ba1e655a5a41

SHA256
e6c6da7a0b9c0296746bf2f014c0a8bc0d7681dc7bc88acaac5517f9c01bdb43

SHA512
8f967b693d2405595f7f521d6189272bed20fe54c5ce7679f60788d36b50f9cd923af7070e7c604a6956113cb65ad08d21289adc139f2b42fa65fa21acb3f6f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
10e9efa12c356cbcecd10ef99475979b

SHA1
aa315cedf83d6f79c36e286825ec5c8a31af173b

SHA256
ff62ce5b3d9589e5e1bb7c63227fbfa5a07b6c7793ad785e14a99bcc2299a6bb

SHA512
9bf29fc93c75a34ceb820bc62fbd8c2f58db62eec82cfbeb628cacb12dc7b2516db9ff2bec029efb233ce2327dc313361b4a65e80df79090c063f9196952f8de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aa1a312c9267e33f1e1c6ca4c43301a4

SHA1
e224993ec5165563661b3f443df44baeed356c70

SHA256
d0f4daa4f227f1d44d0021bbe53ea12afd652ae2330119bc6221279e2667035e

SHA512
0a5d3be0a3c644b37ce720255e6507710948d6ebbd50a7592b033462235d8851d28cd5f0f4d631082ee8c531805fc3ce88dcfdc5a6fe46d6b030ea2b774afd15

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6acffd81d597cd04373ba4a47de17c13

SHA1
d10d483225791621fd7bc86ad56f1f026f26488c

SHA256
06bd2412190a7d972e2bdea16cec59b2625a49ecd0a24154222b9690938edd10

SHA512
4dd38548ddc7586a897383426bc4b328f0118147bcb6461d2fa299b5f6341b604208e8baab63b125d03528f132c26ae8f71695781e90c2200e7de93c9e7a024d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
a56f1550f85cf19145ae15698c481de1

SHA1
1955f796b3bbe1bf695a812ad71ab2bea5a5ea51

SHA256
cff9ecac7c9b979c826e03b2a32143709cf0471d4274c1dadb2152797800966a

SHA512
cd6889f046afcdc071b53fbdcc313909e832cfc3d5af609b07117d96e9351828a8c6509e82fcce56607918c309b5f720ae9b6e307d3326f84dbeecb800d358e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7CNUR30T\plusone[1].js

Filesize
62KB

MD5
1106da066ce809fb5afe9c6c1b4185b2

SHA1
3b64d3a7f52b4c07047fa8727db4207137733bf8

SHA256
d0f3af1e716ce7846e7c252ace160c12480d41eecd5a7e7917ee5b2ccde62b51

SHA512
3f0205b89d5293f14d863e344680a9d8518e5d4ee3b981dc5981106534bd597ed6b388eecab1385320f77c8d5a46a4ce5b64f03f4377b8ea13ecf9b569878fd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EOYL2MRI\A0AL2B9J.htm

Filesize
62KB

MD5
5ca67e9e4e367e4a7ba11293d6eac798

SHA1
4bb3d5c2a2fe9638e0b87d42dadd93a74627d048

SHA256
836b871fcabf9062d8ff557d8f654d9ef9f521000d621af2c4205939151c8192

SHA512
3a0bf17e22c86a3078ac2557d0f3cbafaf307d99feef90754cab417a458a53abaa9cfda8c7b2730384f7e92b995f7d05da8de1d9bb4a8e30ac9d6ec3f73a40be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\M4TQDAHL\BidVertiser[1].htm

Filesize
87B

MD5
6c60754af27389e2778b3584bf10f3a1

SHA1
196be0cdc74708ee01c01f86a648c16573e18fc6

SHA256
ff2485a3dc35082ae7e3799388665929ffd72227191bf24b7c01033bfe19ddd9

SHA512
36724f44d31c798e9c641567f282807f4cb357dc7ed4a9ef8ba633d8c2f14477dac67f4afb3f1f131dd16489d615114486eddc2cc34eff9e0d3b3cc443fa464f

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF02B.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF0E9.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit