socgholish | 90f8203cf19c384049fcdcf180f6691886ad6b0db6a16b6e58d05c5c47d094eb

Analysis

max time kernel
143s
max time network
149s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
15-12-2024 00:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f1736274a3ec74106fb3156553d0adda_JaffaCakes118.html
Size

112KB
MD5

f1736274a3ec74106fb3156553d0adda
SHA1

211f112bdb3ca6a3c6f12610ce90018b2447e3d5
SHA256

90f8203cf19c384049fcdcf180f6691886ad6b0db6a16b6e58d05c5c47d094eb
SHA512

071f63e8800343b40c8078c553927d9175723d4ee3a776b805688fab4cbef2d7b74946f2fc681ba55a504e7c339f89bf03e471b21c784c3450e15e05b3b4f0dc
SSDEEP

768:YUmugOriWNcaeCfO2KWmc9/FEOWNUV4KP27ZyYIDzCyroMxLF3eicno7Eh5I2FuL:YUmFuO2yFOGHgkoRMjLu4Xs

Score

10^/10

socgholish discovery downloader

Malware Config

Signatures

SocGholish
SocGholish is a JavaScript payload that downloads other malware.
downloader socgholish
Socgholish family
socgholish

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D2D95181-BA7B-11EF-AB7C-F2BBDB1F0DCB} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "440384513"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1952	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2440	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2440	iexplore.exe
2440	iexplore.exe
1952	IEXPLORE.EXE
1952	IEXPLORE.EXE
1952	IEXPLORE.EXE
1952	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2440 wrote to memory of 1952	2440	iexplore.exe	30
PID 2440 wrote to memory of 1952	2440	iexplore.exe	30
PID 2440 wrote to memory of 1952	2440	iexplore.exe	30
PID 2440 wrote to memory of 1952	2440	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\f1736274a3ec74106fb3156553d0adda_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2440
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2440 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:1952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
fe9b584fb83ff8a7f6a72f6715ada12e

SHA1
05b27507e0fc465277256ff90c57358c668144f7

SHA256
b80d37ddcec3580c14a29a3742b55530c39e08218ab8c4ca4c0a1e3075bdf0b4

SHA512
d81e49b98803dd0c2643a81934f7bdc2b79f4cf70e36f0d48e8724cf0b1fa3ecd07adbf72439da8685bc8f375a352fc1fe0781fca3492488b9cf919603c3049a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d5e56ab3d09d03f1905eeead76f52fcf

SHA1
564f331ff110b02422c5a8c143cb6f505d0c2b26

SHA256
74eb9572016f2262bd168064adf4cc1eb920a365ea80b9a5cb15e7bcc8903759

SHA512
898d799e5737a8bb2eb107fb9eab00247b2da8cb0d2ec7c1238872ed0be8dba6d159245dd4a8384f6385d5dd253f3a0928872be6bfcf656023ace9d8f5222c73

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9d502e5c1f08a6866d72095da8ecfba7

SHA1
abc1025a30b8651f30134b70380abb1b129c1311

SHA256
a54b6fa69180314362243717e36b58457a7b34408ee0a0e4994be58963b0cd3f

SHA512
ded954f6126775c285a87d1ebed8dded5819f69add3b7af71f9f61d61db4460bede0430d8b243bcd327ec785b0b0e5a72db132d4f6ec361ccb2c8557686ee4ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5c047f3d2c92fcba89b26335b9d88443

SHA1
b7856f16312a3a77ceca454bffe2d6fa3939e4f6

SHA256
07ac15a7cdf1460bf5188f280179aa228f7939847b1451fbc25df5e2bb372ae8

SHA512
bfb05611d2c4674ef9bc764b72f780e5537048e6cbc07f40787a8ebf6db1d557cf50a22c06a8f012eb1568c17c2d29eaa930c0f130c32befe2048ecc76192f88

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8dda6535a5d428499ffb930fa0b9b5b5

SHA1
96ff7c0c9bd2e125728ff69cc513d9f43d423f8b

SHA256
818ca26464d89f0b2ffc548bd498437a99d5c4c4d4c305ce847e93fe2d070f4e

SHA512
f2f88058fc03f52641d6c8f0432a8d1858412456321cca9349f4ce902756434e1c0bc88db4d4d263431beceae738c4f7f215889c2a7c41cd0472b3cdb57c03b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bb0a713c066b9b254fc7be11d9af8c24

SHA1
f04b53d9b48c91019654c6d34f4843c84cf261e0

SHA256
0d2b903eec63421259add21700aa734118565bbcc5fe23dc7fe1301f9840305a

SHA512
7707810f7953378a769c831e2fff89968d9b1b3b888412c2e78904f5f51af2d61df9c4a3440ae1e6e4eecb25da72e90e65925231846166d63a0b8f474e2a2a69

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c1d60f473fd7b96f601218e75e75e521

SHA1
f0a2994415bf7efdfbe52f4b3af008a3c1fd6f44

SHA256
34e76719c6af3f4cf6ba8bed34637185d58cbaddb66b4cd82caa58ed1b7343cd

SHA512
79cb58d901bbb814fce9af5fcde40b5b64e956d560b9a7ea03d2493b319a84dd2b25a64bec95cf94bc7bb455186c353bffa479d1ec79abc66915ebea133d71cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2803d5824221315e5586d79eb870e1c8

SHA1
ecc1aa0349a4a2bb000ad709c055b4c0f12e0b1e

SHA256
9fdada56c8b517c7ca827b40f874569af9c8f9db4ab0d01dda82a0f019136eae

SHA512
d803d8d80c5f7944207b8d3d734055afe0c188c3926e194d6dfbe864f389c6d7d7b8d4b0a0d371564f0ce96d9d4fb52d72535bf1c56de2462f00cd224124b080

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
289ba4b7d6b79da5b920c60ce934b164

SHA1
edc319c298444dd0f8748d00fa690d94aeb980f6

SHA256
9a1fa8a9d72a82606230c0843f6736ff201aae8d82f2609e3bca2af30b4265f7

SHA512
cfe1233e92e074ed6d8f501f636a05802f98fee83e74a4a6ef6ae9468f7ae22967e98d49f54a918c5bb1ae0a83137cbdc5eae1fda73d33877dab5ecbb46bd021

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9104097315401ac60e019fccbb080f6f

SHA1
27ceff62b044bace1459c11ac45525f630bdfe52

SHA256
15af36f0e7d7700b908a6848aa993962c0f3aedfef83c3bc08dde8a719da667f

SHA512
248da6da14af09f2eb6984e5cd596862604592cb3ef61b05c3b3bf5c049ba3b4e690cb3ee507676bf684623a372eb3613144ddcbfcf398084443e4f7e09d8a9f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b72cd763f9ce506dc6fe844ea3040601

SHA1
52634a1a12df54cfc446195034657906197e73c9

SHA256
755ffee21941beb5769911a27db38ade26243e628a1fab540a5d92fc649972d0

SHA512
51d8b67f1cc5bbb9c31593856d0834c533d897b85fd0ece5baf715dc177650dbd4f744818f1ef2fed5f0652ad7384eff55d8226666ae704639604061cbdbe46b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
80f29a9c808d3681af89e714ae2d96f9

SHA1
d10d6424759ba0722510e8459ef09d3c9ade8b00

SHA256
1939b3e3d3154cb46bfb5c181648cee22c5318d06cd922df8f9d17b869f88333

SHA512
30d5374d0bb16aa8774168365d20a2f826db486603b914c8f170dea211f7863a5f5a6f89d7e84b7ee446f1c09cc79a13f7ee4cf370e9c99dd05f06b3221cbc0e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
7390c1b46f1e39582dfb50f45957eb20

SHA1
cabead36e1ed3d6db64949c1118dde4e9fa4f626

SHA256
57f4447ea947dcf5f56fcfd5af196446b87c5ce6a76d61898ac8bfc19508d73c

SHA512
8cb761f9181a09738881cd41771583b291745c3b8f2c827e44d11551e1ed349a0ddd4336a5974e30594bda8fc5638948a62a7a85db2a456549fbc2aa51ce327d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9UR26M8S\plusone[1].js

Filesize
62KB

MD5
2693cd35d818b48f4cd562c6abe0db29

SHA1
131c844eb658219966c722b60cc12c8a542ebe06

SHA256
911fa262008c6ef2bcf8448ad83a5aa8129c39355b98d957f5c7dde2babf9b7c

SHA512
4f692bd49811addfe89d14b156fed6513f04ec4be2629086a8b66ddcd6e7b8b7df149fa017173824c30f7492c2320a3d7b9c0344d5e1f7074742558125654f1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\AS91FDNI\banner_show[1].htm

Filesize
162B

MD5
4f8e702cc244ec5d4de32740c0ecbd97

SHA1
3adb1f02d5b6054de0046e367c1d687b6cdf7aff

SHA256
9e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a

SHA512
21047fea5269fee75a2a187aa09316519e35068cb2f2f76cfaf371e5224445e9d5c98497bd76fb9608d2b73e9dac1a3f5bfadfdc4623c479d53ecf93d81d3c9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1EC9.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1F39.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit