socgholish | d56e872e5f81cefc94904a54f7be3e63001f7cc7b3061ca6d4aa50f4fbdcf21e

Analysis

max time kernel
143s
max time network
146s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
18/12/2024, 22:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

fd4c591509bebba09f932d79ac421aa7_JaffaCakes118.html
Size

77KB
MD5

fd4c591509bebba09f932d79ac421aa7
SHA1

bd66cc4d9461e2ded059ac6c97f9d2b199d9c35c
SHA256

d56e872e5f81cefc94904a54f7be3e63001f7cc7b3061ca6d4aa50f4fbdcf21e
SHA512

f0870ec0706fe56424bb6c5e33f252a8be2cebe43a51a48b003d5686b1ca114efa951da9c90d0ae32ddbb2ca22a35d664b03169dd55117eca1270e68a18a5d2c
SSDEEP

1536:8BeHMLnVXkIkIkIkIkIkIkIkIkIkIkIkIkIkwkwkwkwkwkwkwkwkwkwkwkFVkl2R:NMLVEkl+Q9Trh7O6lg

Score

10^/10

socgholish discovery downloader

Malware Config

Signatures

SocGholish
SocGholish is a JavaScript payload that downloads other malware.
downloader socgholish
Socgholish family
socgholish

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{08DB65D1-BD8C-11EF-BA23-C60424AAF5E1} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fd6fc971d5a04846ad5f6c686653c4f2000000000200000000001066000000010000200000001a1ea48d61a29159929b5463769479a193e84ce8b3ade4300018f34328ca3719000000000e80000000020000200000003a0c7fee036426dc7879c101bb110a22096c4a74af4a131fe4196c2e7cb1dd59900000007c4ffd9b747c082b78168b3db87c0d309dab722433534f045b704a2bf7225921aa458ebf54986977369daf30b2d7405e8671ba9e42b8082a777f8fcb5a8d65af73919273d81a31a9fdd92d24aa417ecf0ea33c6b64e1764543d3533cb283afdaed7305e49f38086153ac8b304405eb08d4862f00ed635adac41a883042e08c02006c05558801357cc7f109220fd1a8d4400000005ef36f06bc40a2791ff6940168d4462f213aae1373731c16473db7ce775208983f373618ad0bc4eff54e7065d5462a7be127ae8aa13a2a9895048c2ba9a046cc	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fd6fc971d5a04846ad5f6c686653c4f200000000020000000000106600000001000020000000a62e83e0fe2ce6edef867f1625b73241afa7ad8617fc02af4e52f0ce9b0d7916000000000e8000000002000020000000e8fa33076d94ae049cc723faeb0384d3019122fbbb85c5db438301e66754b2e020000000dec18d9e637bcab4badd5bc5f1f35aaea21cb3970126910619b6732ce2b94651400000001ac277887c12b818a3887db69efb30ff441a91843e8a42a5899276be0992fff3e0185be4d04c2c65c9388829a1511013834f3c9dd6ac4a2d14535bc4fb714ca9	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0a07de09851db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "440721358"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1968	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1968	iexplore.exe
1968	iexplore.exe
2060	IEXPLORE.EXE
2060	IEXPLORE.EXE
2060	IEXPLORE.EXE
2060	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1968 wrote to memory of 2060	1968	iexplore.exe	30
PID 1968 wrote to memory of 2060	1968	iexplore.exe	30
PID 1968 wrote to memory of 2060	1968	iexplore.exe	30
PID 1968 wrote to memory of 2060	1968	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fd4c591509bebba09f932d79ac421aa7_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1968 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
4e4faa703b3d357dedd9469a4373dfb5

SHA1
f49f361f89d036dd852077df561f5e9286fd9dfd

SHA256
6d9cb85af42adf2bd415c8319d17e8332a0e02f20f1f885adcfafce8505c87ea

SHA512
3169113e38eff8a2b0a68756209c93cf33d5a4bd6059f957ff089fec1ec32a8b8a3189a6160bd69a0471b76fbfbdac4172f101417289c4ac4dee4dec2053631c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
064df630f0253bf61a034701effcaea8

SHA1
769c9c24765b8500caf1e0786deabe021578a269

SHA256
7f75866a3573d3384367e09f854aa9b80376fb332584dbb12e27af1cbcd5ab23

SHA512
3df0d825600eec324ce489c0879a9f25c34f01b71d06bc13eaeb17aa8bef0df9a74d469815a4160b4d9102933b1ebd946cf5618d76d427cb7e54671dd2069927

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
877fee8e92e3f592baea06d44f078dc9

SHA1
c8e81f82a95c3c8b116bc610e33d71e41665d242

SHA256
02c60e3a18b07462cba8dfa0dba1dd9ffbbfa05970d669111eea56d433b94496

SHA512
9c7da9a2c7f2aae4fa89732748e082fe5bce57212e2af31397d222639bcdb7f5e5a4bffc3b8331eb776901fb24d3faa5b1cbcc8321013c7f77cc37bed8ecaf08

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
11f91bc58621d7e380518eb0842ed625

SHA1
a951aa76f1d00523fa8f4a5774e06f80d257aaa6

SHA256
9c1f3af1be7c01013d3788a14228824dc912acd9d005b269b4d6693359dbb323

SHA512
c7dc97e0a45cba37a4ceff4b608decbc3b69ecddcfbb0dc4e7537c3f108a31031ab153a4ca9cae69ba18888878aead09597ccf2c1146b7dcd03d52457d40baff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
24b48dbeee1acf846467ef539a5111c7

SHA1
084e25f083de021c1ade3c651ddf4403e83e0ddb

SHA256
437a73643d8874937391971c8de021fce3ddc89af051c53ec42c5b32029cbf4c

SHA512
23793219c909cced48d832953dae9aae49f2d7b8caa32354d24976f0a3cbb7c19ad1b1e1e39ed99eabca31687623ba13a705802e32e9dfc88b8d27da8f106cea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
817b302d5ce43bc6a6654db32faf1612

SHA1
332b21b7a6a2e812a0f39e9e812ab3fa602a2842

SHA256
40d087183dbf53cea7e756ca847fe0e11c4a50edea7b85c1a016dc3122b7a5e6

SHA512
841f4d8fd369bbc8529c97a3fbbccc7e768a5096617c583201ee04d82555a0cfa2477454dac2bc75ab24790440c469f7d6c176be9ea2a4ab4d6f7f55dd92ad50

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2d39fe09f468614c217c0f292683fdb5

SHA1
f59a149161d1fb67ffd7a81ac030dda03a81296f

SHA256
f63c6b31eafda7d0c7b1a5af21054323fd32f4d52887b81e44bfb6c0c019b68e

SHA512
783a1f2f6606c37eafd2a5f368b2e69637971cb4f1983dde2e3ede89284346cce8609dd3699310d7b885f06a2e0aad6f51d10c9e1945b5d8f22e12ba8940fb00

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8f53f655105e9f6faa336f10c4ac8354

SHA1
e1271b39f0abe9572f5871f33e11202d5bfc42cb

SHA256
7309f0ffa6cb2888ea40100a667b3b956424e7cd028ae72aac853c601b80205d

SHA512
36237c20f4a81e4c48ccfc57ee0ca5dad1d1be2383c7fcb878a80b7078a7a1b71d109ab57fd1ae7c9a86ad039e91230bc5386cda2cc68a734c00f170ef66a585

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bd16c16ceaa0e31310e0235d8041cc31

SHA1
e3f0953fbfee13e10a55e1c9ef2774debf8cbdb1

SHA256
15feb3ea4d37ac6749b23c979e36c53420f6b3e2b1edd662672c5d67d206e00f

SHA512
bc3bada87c1e06e30dbaa40b5ae6aae9ee6ca607d4571184ee4844520d210c9b7d920985c79d79af3b54ac68dcb5b5c66df05a85e81a6d2476ff503b233b6714

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1c26ad0abe41252d76e5b3eac600f6aa

SHA1
237c5e0534ff3b243333a0764d638e1f211ea658

SHA256
007260f60192959a63c40b8d510ac63d3a333689c0937e83ed7e187523142ca5

SHA512
f7ca959b85d2b938317076ff019f7efaa5e754f5f86b509ef244cb39e2cd222331cd7fc9da4796f4a23b82636dfb7ec554c67fbb6ad7813aaa4429948af90034

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
748c2ce2cfc63b519bd7d36e428b5286

SHA1
6dc472f937ab57d0c719650a8b8ef9aae15d2e8b

SHA256
03ebd21e7de2ef84b7594df0c812091841d209e7bfa2c10ec4e7665de19a5cf2

SHA512
5f3f71f1e3e4219ec870ca5373f39dbbd28ac2e2e1ef1433a3fdb16603f5005397cf776992fd9c5f87b0fafe148829e378ca97b8e086e51df5eea05ccec17c5f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
33e74c9581071d151cfa97b5c2805382

SHA1
d9511629f17c22aac15b96131993408c954c8bc7

SHA256
98fc5a63a025ee1ed425d090f11e4a7b70139a72b67661c9b2ef6087c1e20722

SHA512
763ed5a88d65cd9ad82f3cd58155677bc2c72a7a141ad080dd4af2f7f6de98e830f167ffc0f17ebf4e2b621bf75210c85ef0b17aad7d96e177e7fdf46de79a61

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB9EF.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBA9D.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit