socgholish | 279264dbcbcba76d06e69fd5612f4f1f6ab2a91776d00acbd63ac173e77ce9ab

Analysis

max time kernel
140s
max time network
146s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05/12/2024, 05:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c6242fea2173f2525cbfa4eee78b2e04_JaffaCakes118.html
Size

159KB
MD5

c6242fea2173f2525cbfa4eee78b2e04
SHA1

1e6b4ba337bf3455281765cf479982db64016123
SHA256

279264dbcbcba76d06e69fd5612f4f1f6ab2a91776d00acbd63ac173e77ce9ab
SHA512

fe18e2997d06f96ff576969df83a7244b99f6751abfbaf7f0249191193cbe16c83ac629288d3ff097b0b4a207c702b9be5be95f93ca18d04aba61c684d2bf060
SSDEEP

3072:fqx9UcjvG8rMUcXmNRS7vaCCSZi0od0439IL82xc4K4vRmrFUkxxmZtuI:f4GXmNRc20KbhI

Score

10^/10

socgholish discovery downloader

Malware Config

Signatures

SocGholish
SocGholish is a JavaScript payload that downloads other malware.
downloader socgholish
Socgholish family
socgholish

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "439538712"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{89A76691-B2CA-11EF-BE65-4E0B11BE40FD} = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2824	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2824	iexplore.exe
2824	iexplore.exe
2688	IEXPLORE.EXE
2688	IEXPLORE.EXE
2688	IEXPLORE.EXE
2688	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2824 wrote to memory of 2688	2824	iexplore.exe	30
PID 2824 wrote to memory of 2688	2824	iexplore.exe	30
PID 2824 wrote to memory of 2688	2824	iexplore.exe	30
PID 2824 wrote to memory of 2688	2824	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c6242fea2173f2525cbfa4eee78b2e04_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2824
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2824 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
3515ae47d15c6e214f2ec4dfa4712466

SHA1
cde16d5a53181c82823f0d93dc057b0fc3ae906c

SHA256
37ed098bc07fdaa8f11662c17c2651ed447833ca6b721e731e20830178a5914e

SHA512
134e857a43c4e8b2e526bf5b99a62b24f2e57f281acd0fe09a9681a088d1404eb03766a73af56df3288d1c2d34e326ad9cefe41c29e367524e809cc6a308f43c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f99217f824d61734b5d26da6542352b7

SHA1
59890d0fc78e195254dfc5b6853afb04c83d1cf6

SHA256
babab25a07b47a5e47c36db3cd9127bba1e8e91ff2d1f01f7cf7f941023b6e73

SHA512
d1d36536e0f21cf6c27a58d47d68c6622a0dbf517550ceb3f586731f758896a5512a7960e9ed00b1a45a45655bebddf09b56c1c2cf20184a13434bf30856eb3a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
341ed2598021c95a898c435ec189a982

SHA1
9284d52636b4b83da2797b0aa3ebe560402e360a

SHA256
d24e960c2bb159406be5c28d78385187764bb3251228560afea41637d10ddbe2

SHA512
5710fa30489dc42e0f49d7c9a58a702cff0df3e6917a0d08d22d3c312bf61440bc69cde99bc1e3e7bf90525c7727699bd46a2ea07ba9ed1f146a7e49f5071974

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ca2dedc541ce3b262558d3c3dfa80283

SHA1
387d2e6554dd99ef3e9e279175666f1007226390

SHA256
017fe6da4c0124174df3a3206b92cd410702a848827a8670e45388b43702667c

SHA512
027f4668bed93dcb56ee6517245a3cc6ef4b602987e195707864872e4a8db19ef63dd42258da2569f98187328be6044cb4871cdc64701a6653721e9226499d92

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
817a78e2e3368074022360d09c6fd9aa

SHA1
82d47e6b6aa1568313fe0cc3ef97ba7e5d6ef581

SHA256
7585d8d0bffedd428c6b46e8cc00c350299efd7303fd56ec94cc1ad178554605

SHA512
cc47035cc9b5708c3945ea7b19d62df012e6ff0ddad09b50a74e39b7535da708ca652a03c7a01fdbda0a50bd5ec053a01e3dec122a61e607b6fd0ea8f6115c7c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9bfb225b2e7af6ffc3b44d4077ab82ee

SHA1
56c9abc6ebe114c4b06939f430e6699733bec3d3

SHA256
565f0ac094aea2bb73ea3e73c151f976203998a013b69d45c31756e73ba2419d

SHA512
d07171935a245110fc067fc345f4e1766a9cf51422a3c7a778a3d691ade1f2cec20476c72afec52906e462d1b928e869ac173a5dc45d0707c483a333d710b10e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8448c3b9f443cb9e7e8525cce87dda2f

SHA1
ce4d6bdcad5a5a4dcb71189e2c534cb3ea431278

SHA256
1c097967eca88854adaef86767002af3daf6745f58e5f872c2e86403e2811d6b

SHA512
2ab4905b6ddb2d91269db3988ed7c761d6f605025febc6faa9f96fdc83d4046088698284e624dcf76ee4b4b6b5a9c4d0cd501f5b48029e42f582e53a4b50f296

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
94ac92b0fd1a44b3b1c404e7b0669d32

SHA1
866610fda8d711519639ca35776d595f40bfcd3d

SHA256
5dfb84cb2d94eaa3d261efb8aa7d2b7ba0ce5d5c41f2d55f352ce6b5aab87ea3

SHA512
9e959a3b088eacb5d111dd150b998017fee76a67142ffa07565797eaa57209654cb6a02b705b9a02a582a6f1f13785db196fc667f48f42baa89110576d82b2f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4d96ea0a9b3a86c60ba0e0fc6f077df7

SHA1
5e14ba706c2a7616f34f1c4543b3f0876ae208dc

SHA256
66c43c174dc3059cfc7831223d83868f0f3e8db63a04aa7129de7ce7a00e45f2

SHA512
7341b20fd40b96e203eec39a787688584aab284bc138f4fedfd074e6172958ef0d17469c591b2ce93c47ac7707ab3d5c410eec76a31b8cb064da4b4f81906a1b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9b8111431c071405b960b78c678b4acd

SHA1
f9fe5cfc588f82c4e66e9edefd8e74cf862be982

SHA256
58a2b95140e702dca13cb5faeace5e123cc9ead0cdd2cd2daec8764566be7895

SHA512
345acf5c8687e829a888a18c1935e276ac8c3d3c0e60b2627a3a21f34bd43ed8a704e60267ed5d5be57a3de0ff73061249a91568ab509305ff79a2f2e4c192a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
edd583d16c95426337b547e87ffcd4a7

SHA1
751db70046cdf3e502e192447a1ba02951d4250e

SHA256
b8f0f8b28f8f46d66d59497881f39785e95c1f175699d1c77cbc01469f90c4e9

SHA512
c54121ec19983e3a2730dddebee433356d08ae02b7a39cc00447f5fbe7d94839474239ba436439c8f7ad536cb727c5344287e16dcf7eb51449f8d0839e8e2b9e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
eb742cfb610ce15ac3884d87598da01a

SHA1
352fa23e351ff3601e7deb2675227cb42aad679f

SHA256
663aff2b1eb2c9d377d45374750b2531a0061949783570ec0177ceeb1a974312

SHA512
62231361fa7d361ab44b891a4e38017193043eed97cebe4f7357082c4d61ba3fabdb97fe32aa05b07214a10d034271cc25c30ffa540d7faa1556b81d1a47977c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9UR26M8S\plusone[1].js

Filesize
62KB

MD5
2693cd35d818b48f4cd562c6abe0db29

SHA1
131c844eb658219966c722b60cc12c8a542ebe06

SHA256
911fa262008c6ef2bcf8448ad83a5aa8129c39355b98d957f5c7dde2babf9b7c

SHA512
4f692bd49811addfe89d14b156fed6513f04ec4be2629086a8b66ddcd6e7b8b7df149fa017173824c30f7492c2320a3d7b9c0344d5e1f7074742558125654f1f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5F30.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5F43.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit