socgholish | 18a3dcddf0f3efc8ce2fb1e40442b69f0569dd81f80e8e316781481b2705d048

Analysis

max time kernel
145s
max time network
146s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
08-01-2025 07:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_924f2241e67db18583ee8c09e352a70b.html
Size

85KB
MD5

924f2241e67db18583ee8c09e352a70b
SHA1

0b221a523bfdd4eb2be595a93540325d04aab8db
SHA256

18a3dcddf0f3efc8ce2fb1e40442b69f0569dd81f80e8e316781481b2705d048
SHA512

5033a7358878f1bfff8b37cd7eee519f70198505a0b8ac25697df50255b4f8e301344b216c4d3b0763f03f6f6b15523994d582765e1b033acb47acd88badf897
SSDEEP

1536:9g+xjv/XRyGXmNJUzIfVZeDliFOzcYwPYMorHf4Qk:9BxDAGXmNJUzmZeDliFUcYsYTrHgQk

Score

10^/10

socgholish discovery downloader

Malware Config

Signatures

SocGholish
SocGholish is a JavaScript payload that downloads other malware.
downloader socgholish
Socgholish family
socgholish

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "442482121"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B2AA0901-CD8F-11EF-81BC-F2088C279AF6} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1740	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1740	iexplore.exe
1740	iexplore.exe
2560	IEXPLORE.EXE
2560	IEXPLORE.EXE
2560	IEXPLORE.EXE
2560	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1740 wrote to memory of 2560	1740	iexplore.exe	30
PID 1740 wrote to memory of 2560	1740	iexplore.exe	30
PID 1740 wrote to memory of 2560	1740	iexplore.exe	30
PID 1740 wrote to memory of 2560	1740	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_924f2241e67db18583ee8c09e352a70b.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1740
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1740 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\05DDC6AA91765AACACDB0A5F96DF8199

Filesize
854B

MD5
e935bc5762068caf3e24a2683b1b8a88

SHA1
82b70eb774c0756837fe8d7acbfeec05ecbf5463

SHA256
a8accfcfeb51bd73df23b91f4d89ff1a9eb7438ef5b12e8afda1a6ff1769e89d

SHA512
bed4f6f5357b37662623f1f8afed1a3ebf3810630b2206a0292052a2e754af9dcfe34ee15c289e3d797a8f33330e47c14cbefbc702f74028557ace29bf855f9e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
68633def49b0b9471878462b556f9402

SHA1
299181eee5cefaaf03ae5e4f968baacfda7ce254

SHA256
1df858c748876dadfc71081db56ff48c3d3c7bafaf538e368af96ff2bd532c30

SHA512
11a27cc58c127bd76d28dcc4a1a21f5400457e3c14ca52d6dbcb5f0d8eeffc227c4ec2a70f4f104eac7f89f2bfc9dc401625e220407ccbb12a37e5580778bc0e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199

Filesize
170B

MD5
a075e9d1f02632bcbfea49feda9af8c6

SHA1
6e005405dda960d7850a26e4f2d78b2ed94640a2

SHA256
2d194faf746e915cf5c65d0b2c70b6398d6a6e7644e87d0aa543ce43628b76ef

SHA512
4228a4b862012aa576d57fceb61eb6bd5b17cbae2adcde13bfc7f520e6525d9cbc874dab697c021caae8b016070db43b1465b53c8e578cd7af7157cb50da614f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
eaa19115791498d2160e0555f505ecd3

SHA1
455089eac88c27e16706177f63f6b647a25f8e97

SHA256
b125c87993f8589003eb2b4abfa41b64d9e78d55a190ca05c0c2591ead323eb4

SHA512
b9c095f4325a405e6a78092ca595e324ec1a5d208d28b5f91510902be13b8806ccf719b880237cba8795f359a7e5f1e9efb6c585b50a3ad01a7424c419e566ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
b422097d5c0d591d492abeb0a14a7534

SHA1
1675628c3aa39247dd344fbad8151d26393e10e7

SHA256
02ac5587c80258495067bf80ca7d66c9cfa2180a75ffa4983c8d909fd8e3ea90

SHA512
ad591ae5586382ac8d22a5789d37e1912d9b401903cb68859779fad6988c151066b763bd13c6620d20f30ddc714aaacb994304cac9e8ca62713880a8aa73be7e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
396401bd8742f36b21a91c6aa85c64a9

SHA1
225290210cbcf5a2f25067a42718768a8a354af9

SHA256
600a8b2046ef1e6d66ab030cac5870b7d52beb332b5ba256ad26660b0e31a36c

SHA512
4323e4faf23f18d802598e43e019641e0db055662386fd582ad95851cbb86d169e4c87d96dc2537eab699437514127e38b2c5f92fc43e4f8f30e5478807a5788

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b917f51afa8292146dd2dffc8e603b77

SHA1
ad8ac67ab98fd06d2f7dd8b0d187eef5c569c0b5

SHA256
2009903530a68b006310ecf0d77bdd502049c4d1882e790e6c4b22050b05dfeb

SHA512
253ac1224a807a596ebff00b2d757d376ea2e0e5c0a9cc79d27715942d1a4671b088b99530dc80521943506b804f864f366789f8f49f84a94972e7ca79f31f25

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4f483980a4e831955d0fe3759c57393d

SHA1
c09acc99e71636aa4ffd26f39b2bf6a0e0761f8c

SHA256
dc45c7fb04fe2c3b5ab9d2b78ec69365e783a5ee76d42b9e904c133371a3d7ed

SHA512
a227632dd2ae0fa96438c1472d6751382cf72c32decc853ee78dcf3aaa518fbbc478c4725bcd9427d7325ea720d076c9057ad5611c2b9bb5f251d024931b993a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
45ad818b0ce19caffe672b46718c7904

SHA1
6fdc12ea09fc60fcfaa670082db0d4bfb21ff6c0

SHA256
dc09b407d10c1af85db6527b912cc57431fc8d2ffd877e0d444d5e95f8db23ea

SHA512
908904ab64c5c2ccd64193c91778dd5f33154fea58c810416231b56c1005eaa58107805ee59e5c1cec594d399580110cd56290b589a55c142601038a2bd88da0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
325252a002c69090d0984be74e60807e

SHA1
111af287b49879091e8d07c3021008a658caf4b7

SHA256
23e77a420cd331f3e5152cb0c465a919ab9abe04d484cc6b0bb88d917faea55f

SHA512
44e5f5d7d02159368e42b2781e28300d7fccd878e98f331081ec9717a334573b94aba461e9c3282c9ce1fd1766c4e50dceeb4f27aa29e3ee1832a6e09f99f746

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
719fa8450f8759485ce69d4f3ba2f305

SHA1
36d53d66547f485d3ae56bb683a8897dc1ab7a2a

SHA256
69834db695967dbc08742041c80fd76f42ca03be5b90c3513b05ab3c5a0ce23c

SHA512
cc83e4caf4ed49306d524f9fb4cf1e7b8bf98d6d1314a06a0c3b0be6da4ca9cc4149f8343b10e4cd4a500f01b659ef95b71c37a3a94553eb497e21d95086a5c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4357c251a09cbf754ab2d8c6220602e6

SHA1
7782773e6776ab85a7cf83dae9325d7e4932e2e3

SHA256
99f70f17b61628bc10793aeb7d72b839d00c90e84a1e4c645f9e356782c4ce34

SHA512
00989397bed7f83e958e07a63ba97124c37c102b97ff6967fe431e277ca45949141084611733b7ad508b0509c8848ded205a500f62091c78497bd2cbec138192

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
31f5ebad1a319843b0050d0cdb93e4c1

SHA1
8894b71b1cba1bf82a222ce7c9d326f9ce5e11e8

SHA256
5cbeb46f24915a8f3bf47841795a50bc49a0bd75377c6f115f78369412265fcc

SHA512
9947b8ebda4fceb4eb5fa8fd8d6075614ac55e6dd5e8656539bbf458226ea9f7672c02d6814ee4f7d20e102aa5fa3ec213001fea545e7659036037398d11fbac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2c5ba99429a2571c7342243d74315d08

SHA1
3fe968c26edae3bcfef3c80ef4ced9316ab6b75e

SHA256
9fda20c1c9434095a0cebc2a973a14bb8319cb39c1beddea16393c00bda28a24

SHA512
0ea6930dd55a592dbb636cbb72c1b151f15206b4c25bbcf2c81db5f4016f3f352082b67bb376aeab6ba40203347794f573c2c1b8ce80924737a137a5c58441de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4c8fea59907935ebebe224cd00eb15a5

SHA1
f28b41ff49d9e2f29c40d8c4a8bd12411ad18ed1

SHA256
961036eb413644cf6835348cb4b25ca46290ca5191c0a25230378e6a5df9bdb4

SHA512
46466907f242e0ce55015923671bee256d5bad7b780fe2db062249f233a42125c1a3dda4582dd3511a4c9c5050f6de30d3ae6c98974bf21130c28962062e6fdd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b79ded6947ca83993b77b3fbfdf2eb14

SHA1
2de31b61962236c56e29eb5185bd5d15e179c589

SHA256
4cca0be4704970f561732063da6cbb2752e06c85afef577d91a5af4e00634e54

SHA512
cf18eb614c2985ea87f0e237f1ff774c3879290108c56bde7bd72cd35deb488503f5f3c2a6926a37e7db93eefd8833fefb56b1e11debab1cb83117ea1f5d127a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
d9430e5edc2466b2f3154b0b3892a854

SHA1
88c3deb926e5d8f0955cf3502036fd6158939f36

SHA256
62c62436ddd0de065bb91867caa68ff6e2d72c06b4f112e4522c971adf113897

SHA512
176de9628187ddce3f6283e977aa10d17bb584cddebf50bbb7b99ef2acd96ad9963a39ce6bb19e4b5f3f59d03835a09958020ce0cc18c13a4d6fb0847df731b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5GWW47WY\plusone[1].js

Filesize
62KB

MD5
3c91ec4a05ec32f698b60dc011298dd8

SHA1
f10f0516a67aaf4590d49159cf9d36312653a55e

SHA256
96b335b41362fd966c7e5e547db375ef0be7dcb2aec66bf3646782eeaed4b2cf

SHA512
05345e754b39e9f83514bc3e14b52f3cbf321738fd7d973da55db99035b11b4152fedce2c203eb34376cc9e18571db514ff9fbcb4174a2dd7cca7e439cd25944

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9E35.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9EE3.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit