socgholish | 4c3ad593e3a9a10480f715cf45ea1452d48354410184a540ef44557cca699b59

Analysis

max time kernel
142s
max time network
146s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
14-01-2025 22:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_4751a2543a5bb9c675306e46651f111f.html
Size

74KB
MD5

4751a2543a5bb9c675306e46651f111f
SHA1

04f2c04289729f2aa62647243efef8e3b27c2be2
SHA256

4c3ad593e3a9a10480f715cf45ea1452d48354410184a540ef44557cca699b59
SHA512

1a013d2a34375ded45723e57f37f1ed33bc5fc0f2d6a39e4a7b004c02ddd81e51a4932f3ee901a6ef0e26429b203f11148305a36c7b3f9831b5431526aee5f5e
SSDEEP

1536:iB7obyyo1AaVdyMj6y+UQAKompluodThWEbVq3FDq/0OGlHQVeM:iBKcKaVcby+Uj00odThTbQVDq8OGlHQd

Score

10^/10

socgholish discovery downloader

Malware Config

Signatures

SocGholish
SocGholish is a JavaScript payload that downloads other malware.
downloader socgholish
Socgholish family
socgholish

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E835B7A1-D2CA-11EF-8B64-E6B33176B75A} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "443057308"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2344	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2344	iexplore.exe
2344	iexplore.exe
2356	IEXPLORE.EXE
2356	IEXPLORE.EXE
2356	IEXPLORE.EXE
2356	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2344 wrote to memory of 2356	2344	iexplore.exe	30
PID 2344 wrote to memory of 2356	2344	iexplore.exe	30
PID 2344 wrote to memory of 2356	2344	iexplore.exe	30
PID 2344 wrote to memory of 2356	2344	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4751a2543a5bb9c675306e46651f111f.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2344
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2344 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2356

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
5c7583cff26c0bb50f215b20fa783e0b

SHA1
2e81d2a5622bc10c60c7f2e412db418d6354306b

SHA256
7a77174dfd03a6ea63019e7934baa14c185c3b777188909c22a0c9d5fca5e74a

SHA512
33abd413d93338b2b03d47a21ecf5c9e080dc135abda880083238dce7fa3866826f3267bcd4dae0ea3c6028062434f56d22ad4c60224add3335ea3a3170cd37d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e7db1d41d9eaf7cd67cbb3a9975ee093

SHA1
1660aadfeed4404aee5e638c71aeb078352b199b

SHA256
aeb77374bcf80ecffdaa84118e3f6c1f61419de27404324944528ba1e4d8c5bb

SHA512
e891074013ff786d835642aa0c00d2560672f68baf6c18f2d56990f13ada4a9c83b11974852732d1514e064c54bc6cfa5abf99d4fa15fd33d52800c77d75128d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eac70980a5c6e1a6fba5feafbddc7de7

SHA1
1c1265aa4e2dd42d46675c6359dddf5508a482ff

SHA256
58255005fdd5763cd3d1a6b27c5aabae472e05970f898b03c022068d757e97d0

SHA512
5a47a7d41cc34ecb7a97eccb6c03ecae492dafa43fed6ddec8e877ed1b57669e1c6e3d2b54feb79fa15240b1c19d456b574c82df1f21a5a85dff904e89842888

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4874868069b213e7502fbf85854290ec

SHA1
a3f64115256311bd7cd98747efb437a0b8d53507

SHA256
880035549781b329f163b35dda002bd5b39bf0bb7a24ef8e90e236669305b4d7

SHA512
851dd45974bfb95ff8aaa7b1d804e6f421f4ef6496cbe32c3d03fb122a4f11ca8bd94c9d9849a58b87387d5d222943347665d819c3f77634fefccfce3b261986

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0b46dedfe2ca1507855de17a6aaafc3d

SHA1
d995a8c6a4d6728e1822f237ee7cd7cd665ec669

SHA256
38e99c5a3d671f4d475926b2cad1c01c710d7e1f87283798355e4144bffdd48b

SHA512
f2265efe9ad17fd073a7a613d294faa3d3f2511095c4b38e09fad47dd002792ccd9552ffb8583e48d13950b4d95a6716021519e05420c0e0e4559227c4d8ed98

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
86c2b349780d6480ad830e48a659617e

SHA1
e5a56baca1c76f6979119a455682f2e73fac267d

SHA256
aab9122f67b003b10862994d6758ef3f54a29505a01029dd1163d1788ab44f79

SHA512
fa14b986900f1550840d1eaa29074d369cef3f7b4121844b3a28c83652c58c4f676bf34a5bd45847adc9bc61ad2accae8f64a69a7cf5cb0be43f2fd326fff97e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3eba87beb1dfc6bbb7ff24bcba1a6974

SHA1
093ff1104596a81c1166607f3d4610c601eb4245

SHA256
bfcc7dd1512cc217c702150908ef888d23bb26984ace02c0e8b82497cbeeec6b

SHA512
cb0f931db41e535908086b02966e69fa47435603c4b09822fe511fdf86fd82475b0f380ee8558714401d11fd739a01c976395d834929be616ff6bcc453e38154

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
217ebde7b03bc6c2d00a79d0ab924f7d

SHA1
f6abd5497553fd378a2977bf460d4971cdf21477

SHA256
12cde49adc4f8e3e5506c933690f087d8dcb7e2e7d9ad7c105e99a3f22d726e2

SHA512
5f9d5d2606b6e702edba9b42ea37e5dc290b9683348c5364049ce55a67ad9b5ad6bf85f7f7f686a28f8b6c0f135e377a1280d5cce158a6d3c39819fc06af6a19

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
05732f3f7edcb6a3dbd62ec71cf0d992

SHA1
a2424c6d85c1ba25e0ed1c0546f2753eec6e0389

SHA256
6326fa5aa853da0790a7b28fb4312f844091bdc70410c191c42aac5b0b13b3ed

SHA512
56ddca3ea95800f7bf2c5dbbf7a61304205405c00fee4adb229007cfd183d74771e171e3aab6353bcc5726d89220ebeb411bded66f1b2c77f263d2368ee03bbc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
194114545f9163f6b0bc9385b75fc571

SHA1
dd3f2fca5751ce3e90da6fba74ff9bd7fa45518f

SHA256
d31175abd0837f12804001bba36e303754d9335b607139d74699c5643e741de9

SHA512
31193d84c93e2aac2746a362f357490dba19a6f133ee821fd5e8987c5c598a4cd2ed3631684062c35154c244617b0c8cdd5b5de788c13fb21904c52b7b0f7371

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
91b6a0b8a93acac9b869fe90f90d979d

SHA1
d11a0418b3022004c4cc6a08aa220fac4b291f45

SHA256
097505764c55246ae55551eb046f4c6a895c0d59445c4aa8e22099c85a58a88a

SHA512
67e71aadc48b60163618c226c3e15b0a91ae69381babe567c50922628a936ebcf424848a85ee8656a55b8e545e7f22f50429e5201b6b50ceead59e3809e335ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
f40a78125be0fe82b71de3fb4aa0b31a

SHA1
9933329fcc7fc32e20afc7bba771e402c6969e6f

SHA256
4e4a567bffc01d28da4c2045c050ef538938e86320b4529c49e68c37e2733126

SHA512
485100bb7e083c9507676348240933a54e93b0f9bbe46847e8902ac955dda75963510fd7762469a013385a9161048a3974b24b7151878c5e8b166060f859b5e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BDDDRHWK\f[1].txt

Filesize
44KB

MD5
3d98d6e4340908c9410ac52a218c419e

SHA1
119d4f7f4e3e185b7ee9722d336aed9ff9d317a6

SHA256
939ff7c40a1fb8a6e21e7565198b9c7d89d3181bd6fe6ae0b71495aae5e76884

SHA512
ad7426d9c8278d6db807214a62e39a311cfc2a8d968a3978c17e452942694a74c9c0911d9081e84513aa4ea07cf2d3d5a3ce374c0ce7dffe2bf3d7491821ded4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7C15.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7C27.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit