socgholish | 76f5e69a69072d21752284e29dd87d4c6563552f5d1e56359508248b9a5e99db

Analysis

max time kernel
122s
max time network
151s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11-01-2025 20:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

VirusShare_005b93f47b373357864bb926a7f6df8c.html
Size

125KB
MD5

005b93f47b373357864bb926a7f6df8c
SHA1

58aa32bcc48445d16adb273f1022fb3da22927db
SHA256

76f5e69a69072d21752284e29dd87d4c6563552f5d1e56359508248b9a5e99db
SHA512

ddf1d422c980355e81982ea2aaf1bc6b2d206098a93dc4d8c024e98bbeb69d867c70bfc7f685952a4e4835537e079c47a350c58008b883493f8ba61446ca8c50
SSDEEP

1536:69JEEJXF9BxmCjanDD9BVZfkjnJKlf5wrw+iA:6lJXbXmCjanfVZfcZ

Score

10^/10

socgholish discovery downloader

Malware Config

Signatures

SocGholish
SocGholish is a JavaScript payload that downloads other malware.
downloader socgholish
Socgholish family
socgholish

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "442790793"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5FBF1421-D05E-11EF-869D-46BBF83CD43C} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1736	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1736	iexplore.exe
1736	iexplore.exe
2328	IEXPLORE.EXE
2328	IEXPLORE.EXE
2328	IEXPLORE.EXE
2328	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1736 wrote to memory of 2328	1736	iexplore.exe	30
PID 1736 wrote to memory of 2328	1736	iexplore.exe	30
PID 1736 wrote to memory of 2328	1736	iexplore.exe	30
PID 1736 wrote to memory of 2328	1736	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\VirusShare_005b93f47b373357864bb926a7f6df8c.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1736
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1736 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2328

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12

Filesize
1KB

MD5
c9be626e9715952e9b70f92f912b9787

SHA1
aa2e946d9ad9027172d0d321917942b7562d6abe

SHA256
c13e8d22800c200915f87f71c31185053e4e60ca25de2e41e160e09cd2d815d4

SHA512
7581b7c593785380e9db3ae760af85c1a889f607a3cd2aa5a2695a0e5a0fe8ee751578e88f7d8c997faeda804e2fc2655d859bee2832eace526ed4379edaa3f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8

Filesize
436B

MD5
971c514f84bba0785f80aa1c23edfd79

SHA1
732acea710a87530c6b08ecdf32a110d254a54c8

SHA256
f157ed17fcaf8837fa82f8b69973848c9b10a02636848f995698212a08f31895

SHA512
43dc1425d80e170c645a3e3bb56da8c3acd31bd637329e9e37094ac346ac85434df4edcdbefc05ae00aea33a80a88e2af695997a495611217fe6706075a63c58

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
cb6af17e1ce553c5f45006b55bc447f1

SHA1
e605415b65c1642accb34bff9ae32170c11e908f

SHA256
1e3d4b9225d6250c3e83530dc95b4d9f1047a3f3c4c7d31f648d23344cbf80e0

SHA512
3e69bccd9468b4dca17b2aa746bb3c17123067a8b3faafd0c24701af5a97a681f4f208162fe237581cfada61d3e41f3dfe7cc73f4be67f19bf7214ae6b559ef4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12

Filesize
174B

MD5
1a8142b8b5dd6a47c509aa0173351706

SHA1
fbd767b676833558151a6007ccf57a1202930980

SHA256
4acf8729f9c0c1c75a238a5edf80a07d21c812384c50b60d1ea90763b2d55826

SHA512
ed6caba2ff08926fc7b4ddb75bdf126567e3d6588ac2c4debab81e31ab18c40558c451fde5622c3e25d645e8e3542005084f66bd18a8ef5be774ba3873f75824

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9ba3ec02e67e00d43b2d6d0993dd8bec

SHA1
ae1de6c3ddd089681eeb73356a1add70ebf76a30

SHA256
62c05f464d7cfa5938f74a60615087c730812b55102173e036a6d341bd31b192

SHA512
5d8164a96f7f071fb9cd8770b142ed38f8413057ee86908953bda8418c5a773c537d31ff631b3ef88c0f7469772b931cb25206b5d50dd38ae2eade4631c401de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9a26c490d543ec0acff4adff5043d650

SHA1
878718f1a1ca3b1e7d82974869a9adf93757acdb

SHA256
abd6f5f3a4806ebf767eaaf1ddc50ab5658393e850adc1dcaf7350ea7cb19ce5

SHA512
fc838477a55df64eb0f00ff6b3c5d2b435778abee20fc65a23606fc329a7f21a2fc43d1084e0b5f399a5468e93935eb7d95197d9c2523e13d9933d2b0e5ae77b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c6cdb42c1c5f47bff55117d30809340a

SHA1
a700665b6c09b974b9d4f87d7ac8e39e3a1155dc

SHA256
dc63db5bccb837c5adae0077eaf6e279c80ddb7a10f6926cae367afb032c7a80

SHA512
19cde2c1b69bbd7d8e13d873cf6194de953504495b6d4c76ab3bd08a72a975f407e5d93ed1dba7fc481753a5b88220b9d0470dce981638abbf9aa2403a42f928

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f9fc962aa20c5e8fa417958bf74dab21

SHA1
d511ba194af7b68e39cc93d97bce1808c8ebb266

SHA256
8d94fd72962316da0a2a877fef90f4c337808e67a3d74ba825b6767a42da9e17

SHA512
c39878a41be7c3813f7e15f019306088ac546a446a088ca02256a7156d9f4bc0215514b556d270ae66716c971463ff9feae798b5271a343e847b7612368ff8a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
edd0580105e451a61f3af0d1ba55f60b

SHA1
6f4e458d7f16410c180be0d40030c4a751bdc87f

SHA256
14a12e8c9abb54e377bed135e21e6b1b2221b74def873e890c36e238bc6ab0ff

SHA512
987e4081504e8c6476898a57a2e2031aa01f91a261ad31e67b1a07449133ac3ffe64f784aa9b187d5395928a6455ac01da575ba4e4d3e6cbc92ea47a0fa6f378

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
11d5e75d8fbaaf96bdcde2ab51554f0a

SHA1
918ebe57b826c0fc3274b82fb5d6b12c812cf6c2

SHA256
f1d2d895436e1c970368f1b0ca68356fef64cc1a4bf48b0bd326bcc869c6d208

SHA512
d9178db43c6c4990b975391112bc67a9956a40306a00affba2c1a277e7e74c592f77216222c477ac65634bbe6b903ca327731937a0f1967bbd6b0d345284ef43

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8

Filesize
170B

MD5
de143e8c4c8dd917edd18383a5ef32c3

SHA1
04bd1979d9e11d3df683e5226789308919ff43cd

SHA256
5a7fd86fd92e44277481e5d3f7b5240050f692ff3bc422bc802e1c6c9bb931cf

SHA512
accd05bf361900ae5f6c8a325adbda8f8b3b6579035f0b59aebde81db824e0d6cd6defaeec1d3017b039b45674c9655dc16b1790e0a5ac22225ef9857a0af1ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
5e2528f955cae8dc6a25238aff2ea0fa

SHA1
de67bba9ad526021ebcd8a356a1ae7707db539f0

SHA256
63950eef93bf7034ff2505e957615bfcb65a99efe1d18ec8e52074e8f9748241

SHA512
ed4f68f24d1d755c968861ca98395c9ef35ca0c477baa4cb175e297afd69b965ff200e06505ec904995c3d0694841e5eb45973a6d7ed60938a0a3b6e9c557ab9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\K3VL8XEP\f[1].txt

Filesize
44KB

MD5
7d91634c33c08b3873ac18b6f2a61d36

SHA1
146048b7631db3c5c93d601d505f4b1e4b419d62

SHA256
762af03954033aac1217c5a9e5573f1636fb167ca9d94b930f864e1921b08dc8

SHA512
bae7a0c4851a337803db8f945775649dc5e66c16cc39e2ba40394a3dd734ce9820ccb4718dfbef1b257cf58a2d6a3c2fd01cecce18cd61da84e3d3f0cdd1bdab

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabAE4D.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarAE3C.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit