socgholish | 3fa4f2e20bcade55afa5e8d1681db1fada6974a41150f0485db9fa3ce055dcb5

Analysis

max time kernel
143s
max time network
147s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
06-01-2025 21:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_3b07be96be6c3a282efb26b193b86f10.html
Size

73KB
MD5

3b07be96be6c3a282efb26b193b86f10
SHA1

7ee266246b6d9a5e802e6db65b76ef88e1abe9e0
SHA256

3fa4f2e20bcade55afa5e8d1681db1fada6974a41150f0485db9fa3ce055dcb5
SHA512

681655d2adaa291479a67c9019297318e4211e67344c595532b6c240f1cc5ba750aa85f0c12c4186c74b25e811adcfd36a6fd8187057eb18e936a6351ddd85b0
SSDEEP

1536:SWVOZOMFf43jprQg71mFLJZLJ26iDTgxz/jIeILOrEo+Y+ujNT5+5Ni4:qOMp439rV71UFZLJ2620xz/jIeILOrEZ

Score

10^/10

socgholish discovery downloader

Malware Config

Signatures

SocGholish
SocGholish is a JavaScript payload that downloads other malware.
downloader socgholish
Socgholish family
socgholish

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
87	sites.google.com
94	sites.google.com
95	sites.google.com

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CD847CA1-CC73-11EF-A0E6-E6A546A1E709} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "442360190"	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2244	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1124	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1124	iexplore.exe
1124	iexplore.exe
2244	IEXPLORE.EXE
2244	IEXPLORE.EXE
2244	IEXPLORE.EXE
2244	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1124 wrote to memory of 2244	1124	iexplore.exe	30
PID 1124 wrote to memory of 2244	1124	iexplore.exe	30
PID 1124 wrote to memory of 2244	1124	iexplore.exe	30
PID 1124 wrote to memory of 2244	1124	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3b07be96be6c3a282efb26b193b86f10.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1124
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1124 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2244

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
6cac6b0fdf00ed3b44948b8093f73bfd

SHA1
843df0827dbe3bb274ccff926d774a976801e320

SHA256
1ec0d1dcd044d54c851484f2f3caded2f45d31b1a111d52d238aa98d12a4c1fd

SHA512
5e63479098ecdd9ab8236fe7978f5191e6fd5b62fe4af3eff140415f47fd630ee5af47a7ef280ee31ee73ac86a0dea0f3de07b32c6c71ca3e720bdd0a718c38e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d8b55db9a6ea7405aa698bccd9a3cc81

SHA1
1522d29ce0ff44dd8005fd7e408541eba1467145

SHA256
9e336cce927bce350c8576bb28a892a0fe893e8b4cc135c326771028c8bd6e85

SHA512
18017431795e5d5806a17f4d777f8aa70f464197ed8fc3ed35c015743cb63ef096cd55e39b8e107363a7c4e7008e59b3bebb2b0490e1b89c21a9dda1e4bec488

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6968086e2c124dd3eecaee3790c93192

SHA1
430fd5038471d4807aa061e92c67a4de511ded4c

SHA256
8dd7dfa1f3e44b909916e8813a7d2a81ac26175ff7c96de3bd0a6e3ff9dce3c1

SHA512
745262f70a328dd4a1e1b00a0e6dad7158d54cedb2ed69606dbc254adf18c452347681020205701de0e2b0206668cac5108c3243b9b2d5cd1407bbf1d7c01121

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dc9420878923155b45cb9097b0a12aac

SHA1
4f126e8243b55edacc6c0388e5a959b4dc77e549

SHA256
12eb17da00ccd3dc15fafa672562057340957338889d095bba4e92fee11aee36

SHA512
09bc640c44c0a5610ce5a48c83427ea5cfb051bf56eadf684906936ca36d21565b06ecde8ef444e7b9d38a2fc16c2f0f870d6f691fe00b17cc36d6dd0f980b3e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
117bd4ff70c1ca732547b87efa89278b

SHA1
4aad78a284644aa98050c3aa4530c8e6e13312f2

SHA256
b3eaca6bff0b52763cc84c8848c8f38e59fde161e818b67671ea9885fb3f6109

SHA512
917ba0158c7fc5b83475c446c883c8a73156683d48c4969b3e9ba3f207358afcb9f140d9918118c26cfd2ee4e8a9db3c347a61a16d478ec5c1a5212b7c1235b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
421276ebf5934749f4a5b0a9cf656bfa

SHA1
2b271ee7d13e750a1ad2e5be13dbfe29d184ba4c

SHA256
48eea60a89b538b076c4a721d8e0a1f2ded8084ddf12698614c24a9cdb352172

SHA512
03d33b61521b4ec1dc6f67fbd99af716238c28fa83ba4967409305076f4de0f2f488005428c939bf44ab3099463eb5778b5fbf0ed90943738db5b3a3de963757

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dac65498e99df9660e45d58015aa71c4

SHA1
801fb55af2f436effdd94ae32bcef34a4b13caa5

SHA256
caffa1671d807548df9681c11b1275aa3f7983cee1def43bc01e576241dbd027

SHA512
35d2814c382e0a2467ad070d55ddb877db9d64b1044cb07dd9adcc653141807c11a7ab784b7e7f254060db9c58a1ae510a961c764d16310226f3c46feb7fd3a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
20770e131b9ef33daa6e4e3490797c1f

SHA1
1eeca20a0e3a0e0182bfff3d158e3e588476a7c9

SHA256
da9c64a97b84fb55345891d2f3b1963effaf0e2b75e6329ebd4443ebad8a51f6

SHA512
aa404cc9109d73545731fb475b213cd1d83ccbb0a8b673bbdbe4d73a70a9d132cd8ebc60d4c0a3b0c310bb4385a1f0e03d539f9410f25effd1e3d0c043c6449f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d9ef7c0fdb27a32bc957500fde160805

SHA1
0a5e30b23b085fff631a538f1b8688369e0bd1e1

SHA256
b23e838e75ec7ec33119a7abbe9c31d521de613e85d3916eb02f41226422054a

SHA512
656124c8160b272786f667f580ca10fdd9f734d9d106023b360e46d616657a4ed874a84cf5ac4dd682f5995d29fe312a4ab6ec62413d3cfdc283f40b76ed717a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
66a82fd58f926bb174b0f58f337f5f90

SHA1
36440845499fdf952a4a35f62dd0ad6c39446c2d

SHA256
48fde002159cb14c515b0730c2a225139984fdfcf940469ed63fb250e1c6f092

SHA512
a5241ca6ded22ced78e990bc0b0bdd4259843c0fdc8bd99de5dcfb6353861385059eeac80fa9bd215c9f4aa1fbc16cafb0f87ec9d6d9684767e2797adc249915

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9cb40bfa2cdf73a8a11a82d4f841ab87

SHA1
9753eec93903ae0ca2f6f9635f1b7700d5a1676a

SHA256
64cf2ebaa09a2bd185d688a892b94c849f0b688ccfba1f00b8ad07b064a9df8a

SHA512
2d855797ec73b3419747be86f2b3d6f67483424abe3b0ba9e1c23546b7d6ae02c4a7d9ab0a3beff85f41fdf2a0866bf2b1d44cc2ebe568e2e7c453983e8634fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1225816b80d83d81ab16a7086b8031a3

SHA1
577460b1edd6d780176b6e82213eaf143e05be7d

SHA256
2ba154fec1a0336ad94f40ec1cce4a5d3716e69b1f1fa554e04200658eb76dd0

SHA512
ff6aa24a5c7ad411b1f4ac1f9c77f7993abd071a41b294821ed10f2261f0eb35001449f2a902a694c25eb3427f1a12317fb16e20ff96817edf834debcce401c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
5b81abe8da492d4a471fc6341f8a1e54

SHA1
b7ede67b55ae13c290a91fb18811434b999f8f33

SHA256
f3390ab53130a11cb32ce6cfb53a95eb2c7be55f72b80d18db59206c844990c8

SHA512
13098ae2b89f4c995fd8319dc7411555a6d78074f8b6d57f2be00125071cb78dc873758a8b2fcd1bf32af4d86e50f884b7d7510a31a6831d83b1bfddbf3412ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9GP4P3HF\BidVertiser[1].htm

Filesize
87B

MD5
6c60754af27389e2778b3584bf10f3a1

SHA1
196be0cdc74708ee01c01f86a648c16573e18fc6

SHA256
ff2485a3dc35082ae7e3799388665929ffd72227191bf24b7c01033bfe19ddd9

SHA512
36724f44d31c798e9c641567f282807f4cb357dc7ed4a9ef8ba633d8c2f14477dac67f4afb3f1f131dd16489d615114486eddc2cc34eff9e0d3b3cc443fa464f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9GP4P3HF\plusone[1].js

Filesize
62KB

MD5
3c91ec4a05ec32f698b60dc011298dd8

SHA1
f10f0516a67aaf4590d49159cf9d36312653a55e

SHA256
96b335b41362fd966c7e5e547db375ef0be7dcb2aec66bf3646782eeaed4b2cf

SHA512
05345e754b39e9f83514bc3e14b52f3cbf321738fd7d973da55db99035b11b4152fedce2c203eb34376cc9e18571db514ff9fbcb4174a2dd7cca7e439cd25944

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\L6J4GCMD\NMY7TQ9G.htm

Filesize
74KB

MD5
147cbbd47ea3ddbaf0f7abefb9c16c91

SHA1
28f8badb7a412a7abdf5059cbc61693de6c08d64

SHA256
44b4517b94655f9857adb85980e5bc0dae81dde3847315a50ef3f0d00a6ed01b

SHA512
6e14079cd150d1783c7dd4d93c613aafdaa27b4618dbcc25ff4c95cacd1feea600d818b8f24d371496fbbf6889f41de81190e4da21865db400c65e4aa547f2fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC093.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC142.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit