socgholish | 8035a2b92023a9087515c7c82fdedb2e7652f0d3b8547b7c793c9e74e735bd27

Analysis

max time kernel
141s
max time network
144s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04-12-2024 23:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c4dfb6813bebe06d8852e3ecd08462b7_JaffaCakes118.html
Size

157KB
MD5

c4dfb6813bebe06d8852e3ecd08462b7
SHA1

6881a93be5227fdcbed7899965c4e4bbe3fa0584
SHA256

8035a2b92023a9087515c7c82fdedb2e7652f0d3b8547b7c793c9e74e735bd27
SHA512

fe40aa4e73b144ff2524d9a92018fd8e09e8adfb2d831c1dd615322a29b9a810c6ff125be535c399b4d95e550d35b9329e1c56ad321f363e30cee60161b0ab88
SSDEEP

3072:f4x9UcjvG8rMUcXmNRS7vaCCSki0od0Xtir+L82xc4K4vRmrFUkxMmZtdu:f6GXmNRh209YFu

Score

10^/10

socgholish discovery downloader

Malware Config

Signatures

SocGholish
SocGholish is a JavaScript payload that downloads other malware.
downloader socgholish
Socgholish family
socgholish

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5AB1B1F1-B299-11EF-808B-E61828AB23DD} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "439517588"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2276	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2276	iexplore.exe
2276	iexplore.exe
1540	IEXPLORE.EXE
1540	IEXPLORE.EXE
1540	IEXPLORE.EXE
1540	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2276 wrote to memory of 1540	2276	iexplore.exe	28
PID 2276 wrote to memory of 1540	2276	iexplore.exe	28
PID 2276 wrote to memory of 1540	2276	iexplore.exe	28
PID 2276 wrote to memory of 1540	2276	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c4dfb6813bebe06d8852e3ecd08462b7_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2276 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
2db4c6332cc3d7a7b9812fcf956d8703

SHA1
4175e815bf45f74eea4e47a84a63824ac69bface

SHA256
2ca91b62a6ceb8b7fc7794d26dbe1aac13984bd659aff0cf437c05dda0c49b1a

SHA512
491347334f44564f20ade6d322a4138da21cca01136e21006512492120e4aeb5144252724f0c83be765557c2eb087e7d92646c7bf1560ff056bc85ed4ac38441

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a23aef41b6451336cd93e6c8127b31b6

SHA1
42eb5688ab6433b84b5e993600271e408c3b1ce9

SHA256
6f276e82baae1d70552a196ee6ab803b0e1d23034bd1871ad6f0a55111f7655a

SHA512
bf39e54e9e362cac4be6cc9e39d03ff6e47b873bca865d6dc93a424fb7a2a89b11b5d0664b2adcfcaec0a775b37c24e0b47d83c56a0811c3315d5d76e44ed3c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
31bf82b69d7fb39de7649bb1327920c3

SHA1
0ba975f8bb1baa0c3c3241d38ef44aa517185a91

SHA256
e78d891fea5d2e464f6814bcb8dffc25b62bb2e889261889ebd10c039eafc802

SHA512
440b6233b77495f382cbd476bc69efe2e10ed773931f7e1f4c23f74f91909c05b9dd65cd64440f59673f834848aec632a63b316d816ec47b5b4c6c8b473b97f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
109768df3d16bf639d1d4f63b31e80a8

SHA1
0c2012f9708083c8a360c3ec0b58249765cdb428

SHA256
a40bdabab8b0bf13a34281a703c41df23b74f8b0fe84134f2948453c728013c2

SHA512
f7374c3e3b9dcf0740a9cd1dcd7575289b06e3983ec2cc94cc60b4ed6fc271719e9b675ff021062fa7aec321549f2a8f9efa6dcd5135fd309c704a37748eb05e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
70b77dd36e38a6a21e4990b1a27fcf95

SHA1
12302cfd2723a3f8e654f888999d8b1ed08e5749

SHA256
f9337d4f47d222ec024086f8bd58ef22fd836ce94bc2b79d095856416a5b5f72

SHA512
cee8071fe0af3f64042951a21154ba0d1ab6aaad43fd6f03bf209287be815586a1ea6a636b94d04ce1fd36ee78d3beb7167a2367bb82c890d9fb735a4ea5a458

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7ca9594ff8d4a9456c90a96c251d68d9

SHA1
443c3510bb3d3aa80a5810b7b6058a418cd6eeb2

SHA256
1eb8a14064c022a5509bca53a4433143068d7d9ceabb56dfcb59043b5a98b808

SHA512
a8cee559448ca9c98f950666906bbc6ed47ef01a13f25fe35fe9bff6e473b28a804f07b82eafeaaf4e8749c77bb1f222b7df0e95bd9d2f129168a24481b80de5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
68d109dddf08971646c7f8f83b840edc

SHA1
e1b24699c27258fcc63d2cee9c5f72ce4cffc437

SHA256
fdb6a27f8e53d18c1af2362a8c34a2f50f22b30152e59ac11c56a83fbdefe733

SHA512
9e3474d8be42983068653a06e24a7a6d9aab3fb6954c484bf5ca05bd17034825ffd6e1e16971db4995de4d70e605dc063f3e37d3545ecafc50e8d734d1370122

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2328e2bb5d755b81d7e3a530f50483d9

SHA1
51c767257ec8384370eb5f795241b2a4869703b4

SHA256
cd851fa14ae22b45e0a78619909a79d25a0cef61162fed31eb8671c0b990b65c

SHA512
8284dc883ad81054cd78fc22d0c27587e4fc024068c5425e60015dd9e5bc94db487d7b11b3835a3f7e5ecb272b2ff7b3def543220bb0b3d4880914d955168607

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eddadf00ddf9ff3f1f1d364ad912dfdf

SHA1
c3e4220891bebcf48e6dd9165b4f9a1e5876b805

SHA256
2d43749410484c5cf915ddf21034205e30dc6a6d2023b228539ae25a6e999727

SHA512
aaccb760c2edcedd0c49ed0dc0b3dae3977b0f10758854daf4c2bb3f33e04ed5966aa3fe906c6cc078e9a5363b3e77848ea65f8a4744f9e61f801c306a74e714

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
976e4261034e99f330dec9a5f54f402c

SHA1
ddc781fdf355493f4d5742a3c3e9f7bf2671f64a

SHA256
c8ee3126aad7049b7f24288b996bc68c3b3c6fe23d3b5c23cad5bbc7bc446a00

SHA512
ba7c282a8a8cbb214b7ceb071f1e8c26549278850f02ad018e93557bc303c05a8c3bcc48013f5ccc445b045ae66f0a8b35e273c10098408c291e26dcd309028d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
2b6d7b6d20f092e7084846ee7987e6bc

SHA1
58cd7c9a6e48eb82c1a60e393c18a5a55acbda18

SHA256
f2b4e87b814ad4eaee7cb30906c927ac99d2a2b5ade798d416aae7f3203aa299

SHA512
c80d22e9534ffbeef2abbb0ee365122191431dd582c6559c5d359b5cf4854f787ef3281ab485abe55b11dd535de514dd19690ced7186466aed595716e4a7bdad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\K3VL8XEP\plusone[1].js

Filesize
62KB

MD5
2693cd35d818b48f4cd562c6abe0db29

SHA1
131c844eb658219966c722b60cc12c8a542ebe06

SHA256
911fa262008c6ef2bcf8448ad83a5aa8129c39355b98d957f5c7dde2babf9b7c

SHA512
4f692bd49811addfe89d14b156fed6513f04ec4be2629086a8b66ddcd6e7b8b7df149fa017173824c30f7492c2320a3d7b9c0344d5e1f7074742558125654f1f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9A10.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9A0F.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit