socgholish | 8f0a2bbd1c4a4c6c36c532d3eb59ef59ce243dda05d10a1a59637bd580e95e28

Analysis

max time kernel
145s
max time network
145s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
18-12-2024 06:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fa78c424807022058b1397c6bfefd778_JaffaCakes118.html
Size

156KB
MD5

fa78c424807022058b1397c6bfefd778
SHA1

64ac08f82609b647c6cc53c0f4c081ee5a086e15
SHA256

8f0a2bbd1c4a4c6c36c532d3eb59ef59ce243dda05d10a1a59637bd580e95e28
SHA512

9f6ccbc499272116377361815cabdc9649cb4fb3b7984d6ee92e931b52c1d5add26ec3df73bd0618cd946ecb740540f6be7c68ee6739088c17fa359dbde1dc3a
SSDEEP

3072:fxx9UcjvG8rMUcXmNRS7vaCCSHi0od0sNgsL82xc4K4vRmrFUkxqmZt9k:fLGXmNRa20vjk

Score

10^/10

socgholish discovery downloader

Malware Config

Signatures

SocGholish
SocGholish is a JavaScript payload that downloads other malware.
downloader socgholish
Socgholish family
socgholish

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "440665512"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{10E7FB81-BD0A-11EF-9CB9-62CAC36041A9} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1960	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1960	iexplore.exe
1960	iexplore.exe
1856	IEXPLORE.EXE
1856	IEXPLORE.EXE
1856	IEXPLORE.EXE
1856	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1960 wrote to memory of 1856	1960	iexplore.exe	30
PID 1960 wrote to memory of 1856	1960	iexplore.exe	30
PID 1960 wrote to memory of 1856	1960	iexplore.exe	30
PID 1960 wrote to memory of 1856	1960	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fa78c424807022058b1397c6bfefd778_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1960
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1960 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
521dcfcf694b647f04f2c6d698c50c01

SHA1
8f27028920f79e2981d768209356ee39ec3ab902

SHA256
a648b774ed38fe6994cc32ff9565f682628e19c86bee5305aff6e3d2519154a9

SHA512
d47793ebe675a6f6a47d610af0170f7f945e67ac11cd7891ece8ff0dd828c8fa5722f650e42012793742cba5f1d9c38901ed717e0c5efb1ec55b290ed844938e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f75ac3216bc6b9f68e9fe687780b1f08

SHA1
a356af97d74abce14860326121f705aefe965403

SHA256
9d7072d3a222f5a7ceabc9d677412888edc3f010645cf2a7b5af4f94e8d07a24

SHA512
04aaefb8e85362e79ac2c9ff60be22eeee012e8123d9270135d6ccfa33909fc054b522010e2b1229ef16266efa6700f497c791dee58b2d57b28e67f90127a054

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
71afbce62c726d6dadb5453dafbf11fb

SHA1
5163df94adec584bf87831f99f9270f03978bbe8

SHA256
78c230ab6d8489de031d1adee0fc6aa4674a94675d03fbe8a647dbb911b144c2

SHA512
9a82460144d8ede80cd4da8afa6b9fb27d7434c083c8db6c86950d52de9b921275dec55b2c0b4e6d1e15c89606290422f41a2a10268e0bb349829b363106cd6d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fa3a09602456e4a932736ff4f63f7d9f

SHA1
5ea7524997cabe192fbb40cf291f406d810efe8d

SHA256
999faef9d309cf7d418523d520345e8b709689e3d2092e3fb94c0931eda8b844

SHA512
473c8e84276ef20d14834296dcf8811705546e4dc25cff03c3c60df99c577e839ccca562b39c1549279ac06491f2986f35b904c4999d46dbf557630d947e0b13

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e6550af9016fe72a6acaec3035dbab1b

SHA1
86fdb65cd3aa1194cfd14dac5364f11892af8be2

SHA256
547a19ad09bbecd5fe7773f10c6a1e098ac3fc22d973fcd5ee97351c65dc7c0c

SHA512
84a77279c08c8bab48f68670628c8197d9638641be9253de2a59abf1a620da26f7558fe89c0622c7d0171f49e3cd11520032ac74c1a1053e8aa2c6f0cdd02a1c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3a5301f592e5c7141ace69da00ebc5a2

SHA1
1cd7b5a6df72c48f22e617746f61ef2cfa10a255

SHA256
8148c27cc3ae35bb4bbd42db11465317434a7371b076db0e970ed4a2dd48e55f

SHA512
4e64422b8db0a9c9e697a62e878463002165bafaecb09e354937f0c830beec316eeb672cde0121d7aff177d5681407bbd9b68569033e346f7864991266a98359

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a14ae9204a6f84f70f6715684f275828

SHA1
072fecf169568ab21299e1a0efc426d56006e7d3

SHA256
cb2a52c0380d9ac83b31f5b1256e758d53579aab1c22022da86ccf02a29b6f6e

SHA512
d09db035c34eea08cb201228bf55dd4594c99dd0794564e1af51a8e5ba0365cfb369588f3a521bed4d1428558052c7686971ae44a82f36460c05821b0794c205

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2c363a6107fe96094007e366c56b3638

SHA1
8ae3dcd64906556df0a7a91df1ffa2b3918b083d

SHA256
97a4783f909c3ccc1068bca7ce93399fcaddd6720d83dc7016b71ba6c71269ef

SHA512
7e653f7b4c76b879bbcf361ca411e86cafe50481448e9d2a52b3bc050304ffe835ba66155bf7ef9d918b2b9af73abe64573d75ad72d62f4d73e0a20209953217

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ce870192899a43aef725a45994152bc7

SHA1
fefb9388e4067eca73a5b9e5baf4519ac03826a5

SHA256
38b99b3062665e5c4960d0c9539fedec529e56cacf433b255c6653efeefe4375

SHA512
cc02cd70c2160a0f35462add8ec0450428d7dbce374281d3aa0c3211dd77ab5a7d2c6b7d5bbbdd01da8d9611da4c5bf2a63ef12322f480a28de3640b3a54a819

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
96460dd9e7db4d82f4546f0c76a248a1

SHA1
a5d25755c36ec5f353df918943849c6107974153

SHA256
dfbab6f65b1af39ade5e6af38b4c6f0e876a9cf2179b96b0584b25e2de450a05

SHA512
a1f137f2bb0173a9788b73a2211cb49813380f72c3049bf14c3671496570224b8313527815f4b0161077438f1fe3799cb899d9649d1708617af0be0ec42182c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
a5edde9edc183698b9e921ca54819772

SHA1
f7eadadf3f1175d7032e0eed6dac842a81c54fd4

SHA256
b91e2d7f881046c70ab3ec955bcc4413d08c9b604ba31d1d0ee3df73e426d464

SHA512
3e468925adc747eba9706c1a644281132bfeee370e4f780e19d034693c6b89e2b918ddcfa7ab4b81eccb536a3a9ec31a6f9e28503174b8b351662af790e3da43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EOYL2MRI\plusone[1].js

Filesize
62KB

MD5
3c91ec4a05ec32f698b60dc011298dd8

SHA1
f10f0516a67aaf4590d49159cf9d36312653a55e

SHA256
96b335b41362fd966c7e5e547db375ef0be7dcb2aec66bf3646782eeaed4b2cf

SHA512
05345e754b39e9f83514bc3e14b52f3cbf321738fd7d973da55db99035b11b4152fedce2c203eb34376cc9e18571db514ff9fbcb4174a2dd7cca7e439cd25944

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB903.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB915.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit