socgholish | 0978347dde251badbf26fb8a4924a6bd3aa1ac1040933e350bc6144f46b0bd3a

Analysis

max time kernel
119s
max time network
149s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09-01-2025 19:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_d0079e9ccd18c1042c1bba725491fe43.html
Size

79KB
MD5

d0079e9ccd18c1042c1bba725491fe43
SHA1

664a5cf8e7e1f4b4fc8ff9dd829858f319cf5575
SHA256

0978347dde251badbf26fb8a4924a6bd3aa1ac1040933e350bc6144f46b0bd3a
SHA512

c6d90c48ae4b48504e154db250cd92d592ab847f52845b24b32f8788c8ffb95051fe292db8cdd52f3aec3853c140534ab5f811b3a97df4615bfb14c3b9e10c25
SSDEEP

1536:IWVOZOMqf43jprQjMyst6J26KDTgxz/jIeILOrEo+Y+ujNT5+QNv4:EOM+439r7t6J26O0xz/jIeILOrEoZ+uy

Score

10^/10

socgholish discovery downloader

Malware Config

Signatures

SocGholish
SocGholish is a JavaScript payload that downloads other malware.
downloader socgholish
Socgholish family
socgholish

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
99	sites.google.com
111	sites.google.com
112	sites.google.com

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "442611566"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{154F5461-CEBD-11EF-80CF-C28ADB222BBA} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1780	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2932	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2932	iexplore.exe
2932	iexplore.exe
1780	IEXPLORE.EXE
1780	IEXPLORE.EXE
1780	IEXPLORE.EXE
1780	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 1780	2932	iexplore.exe	31
PID 2932 wrote to memory of 1780	2932	iexplore.exe	31
PID 2932 wrote to memory of 1780	2932	iexplore.exe	31
PID 2932 wrote to memory of 1780	2932	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0079e9ccd18c1042c1bba725491fe43.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2932 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:1780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
181bcc542893ae0d13489ddde1120221

SHA1
869e065c2b9b84dbd6b5d3fb4322ef9ef3f24876

SHA256
258d8ba942e99410cd7bc53de8a53a49008cc37a17abe1fabbe7bf53aab2b639

SHA512
2f251344d283fef613638376443d73c4459216f590028ecbf083e70f35faf3043e07965f598b1709e8bcf12aab733988d66a52d979b68a3f3c8752b4990164bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f0943a46e32b9d7c90fa8fcb56c3ed2b

SHA1
69fe6864383a8cd5215c4997856aef6507a7619d

SHA256
1a38bfd3e242f22b5a860353e1474933c153bceccca149f03fa7cdf968bad6be

SHA512
02f07e4c4820c9a7534a85cdbc7edf080ffc1d70fae62e7d7acfdc053064161f1bdf574b17130330390bc3c58188a512e060fee65319fb8cea08a2483ca4302b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b6a1c0689e17d9c84a35c7687832b2e8

SHA1
2d11d331f6df82436e2af334fb0e700f3f94fc99

SHA256
06c42e0075d3f43de5ef87e489e6645d69f85f67a4bed739b74d71f3a2d32aed

SHA512
f851f035dc331e5a4764bb265fbb25641e020bea13cc88582ddeea8906055130e0f71af6c63e76dea205dd16a499efe72396fef838f9cc2ada1dd4f1209b7751

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
20d593414ffe2b6c745f787931af6903

SHA1
ebf7cc2ea73da1ae733484c95f96ad2215364bca

SHA256
9773afeebaa189cc1fca1d10b48b6c6ac2338bf11944314efad6e12cc35fb00e

SHA512
dd832e4d0c9c70de2b5b346c30f5d70ba42844050efa9b99920affb357dc97d9bddab92b3656ff575e33f3b0584dbed1bc029d6919e25c8e6dafef33fa54a5df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dd98da7efa8ff6ca74dfafdde11d8804

SHA1
bbe3f16e95ffdc2237bada8fa26bd38a583b8f6a

SHA256
ebc451e4a3edc3949e36373da6b9f82907805dc6a578b333872535ec4b594652

SHA512
ae45da232823daef2112c69b94914a1abd77d850e7a421ddaa2562bf62ad677cfe06e16f08e24f11dd55c929d66603d20d37c2a0fd53d43627e90e2f1c805a2a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6dedf77d2fcf4f677e29785ee0702807

SHA1
f826b41efb1f2f09f02c5416ce778fc233c8043f

SHA256
a86179a9ff92ddac0599a2a1808aa559f9ccb4b6d45ac3715f1e728e70d43447

SHA512
080597ac991902a472e436e837ab891a5fc9f745edc04f79fed811c08e3517501c6f745a70a9bf053ddfce7ad10539b2a361aa80613efcbc932b6adff9cf00f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
683ed2eb0885a3310384197693903811

SHA1
e367d8170e50ea27d2fd098969d1b910b01a435b

SHA256
65de02aa2ce5640ebcc6ddda83b5241c08e49595b54c4522b2de21a17291690b

SHA512
20258e8778fd779bf17aae4467f22336bb3828d5d246dbd9e3b83b9ef32121803a15c9857535413d11c133f692e3b7285f8904a09fd1f33afaf15b96f1ab67ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4e02966ee995b0344adf924880dd014f

SHA1
e588bc238030089f7d1b22e3fa66d1bce89f68f4

SHA256
1059ff80ad8b749caa01acbbae6f8f2238e8d16b56c76b8edecac67b06a5796a

SHA512
cfc8fc201902d8e907928a3942b06f5e0bd44adf735cab570c593922441734300f0d676055ad1e74360c38be835cc7f217ac5858f390c6bc162e665d6e90b092

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
971f16af9d18ae3ddba9f6c63a9de5af

SHA1
ec8c623cd36fdb4ea0c8ab9c81d947031ccc3d7c

SHA256
00a352b80b1641b8cd829553948694013d81d5556e6c18f599cdc3db5932246e

SHA512
664bd4707c7ab393ff170a41cc7408334c2150cef7d55a56a8cefdd8850dabaaa3c0618ee15916e09b6e9e5aaf1a2956950c38cc78591063f5539d51dfeba167

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0f28256035ffd3ce7231123a396ac6a8

SHA1
f686aad0af8f28684c45046099ee73082527d2f7

SHA256
a841a5a7c56430979222f6bac85100d28583725ec6201e04c52b22bbad34f619

SHA512
c004cfec43e81f17b6dfb6308e257280134373bb722d45b822242b28d5763f8f03245f038081f0c8f7d257445ee7f133133d81394ddafc8599f2617780703119

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
04cc9f24eab458b5f2af01f5357ef21f

SHA1
f33e5b87f41e50b6abf4b04370525be842be0c28

SHA256
a17f610b5ecda4f55b6b15eb5e856d7f920a1956df2d26990e78be6b2db495c5

SHA512
9308ba1fdd6f2d04a841039f9d2e3abfcce31a59ffc8a6ba97b028a12bf6af642a0e248d406d7a584f941fbb47d7adeb8234fea62426b5a3f3d07003eb0ba70a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
055576def1d68bd2384282f8aeef0dea

SHA1
f66bb6b31ad9d7e1e3df22ed22e51a29cd3d6222

SHA256
586142b22623f5eebba340d5da6bc1cbbff55190776a0ee9d60cce64807a191d

SHA512
559ef911bbab8023fabad8e0b3f0b0868def0265eebf045ead6966f5d1ff169f50e5e5439d0363589008b8e0ee3d96270af7bc9f62833e513bbde58f9f4196fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
8b8711b9f6ac20e40ee06bbee9726179

SHA1
0c696b861eef595e440f4dabd2313717b918d979

SHA256
b4f73991b3988376bf356de8aa5d11ce03d723f931b33a997d41b0c254d80352

SHA512
eb47c4a9ae948b5cedb4e8c2448039cfa46baab6235e70c7eb2087051d4f01b43e1d54fc9ba3749b755753b2a1efc0d78480c576de70f49195874d07cd49e6f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7CNUR30T\BidVertiser[1].htm

Filesize
87B

MD5
6c60754af27389e2778b3584bf10f3a1

SHA1
196be0cdc74708ee01c01f86a648c16573e18fc6

SHA256
ff2485a3dc35082ae7e3799388665929ffd72227191bf24b7c01033bfe19ddd9

SHA512
36724f44d31c798e9c641567f282807f4cb357dc7ed4a9ef8ba633d8c2f14477dac67f4afb3f1f131dd16489d615114486eddc2cc34eff9e0d3b3cc443fa464f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EOYL2MRI\6Q5NE1B3.htm

Filesize
75KB

MD5
c3bd0bf75c7b04aee6cc9e33346de44c

SHA1
208041663211fe25033b497f90004a3cee385c7e

SHA256
e9c8b67c51c942fa0ba142c4ba59b02efaa8f6274798f81a6e15a6184c33abe9

SHA512
7374d97b868759023c59f408b188d6c1ea820399eb9df2425d2e0809b4d9b5d8966be7b915ca94e052fa6e68b68390e76d2ab28acfcdc76f4263227e0f379462

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\M4TQDAHL\plusone[1].js

Filesize
62KB

MD5
2e4a448a27b8a58d75f607c7bdcca6f2

SHA1
31cf764c6c2240148eaaa2b9816e1219a273d0bc

SHA256
d3696859f3485d8aa6f8a4d0054d64fc1ee614e57725221dd1c97b930f02bc3e

SHA512
09ca4d8b6a0fc653490921befcb3d752e150ac9abf24d1fdd49c9453fe2baf969b76433a45121451ef642ea3f73f9c62871cdde5e07976ffdc03ee5200e4d35a

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabEE47.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarEF25.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit