socgholish | 4e8bd9203995caf797a15236038c317a493ff058bee7a984087f5cf270ebd37a

Resubmissions

14-01-2025 06:02

250114-grm12ayngt 1

14-01-2025 05:55

250114-gmetvs1jgr 10

Analysis

max time kernel
140s
max time network
145s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
14-01-2025 05:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_36ea6bb89543ac2310d0ba15df3caaa7.html
Size

35KB
MD5

36ea6bb89543ac2310d0ba15df3caaa7
SHA1

67a528fcce088140ec6d7480f6aa3de6df290eb0
SHA256

4e8bd9203995caf797a15236038c317a493ff058bee7a984087f5cf270ebd37a
SHA512

dbd7367eec806c95becbb7145941d812188c860ebe49ad6814051722cd41ad9c8de633994f9263272b39096154ea02ef4c22c310470f393dacfae92a71b92736
SSDEEP

384:Sri+/DxVkrGYqkOW2QZhwC0Dm6Prc4/VLXBawoKoQcCFx0Jd9dkc:Sri4SaYqFM0S6Ph/ZBzR70Jd9dkc

Score

10^/10

socgholish discovery downloader

Malware Config

Signatures

SocGholish
SocGholish is a JavaScript payload that downloads other malware.
downloader socgholish
Socgholish family
socgholish

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "442995972"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{192543B1-D23C-11EF-9D85-5E63E904F626} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2988	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2988	iexplore.exe
2988	iexplore.exe
2292	IEXPLORE.EXE
2292	IEXPLORE.EXE
2292	IEXPLORE.EXE
2292	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2988 wrote to memory of 2292	2988	iexplore.exe	30
PID 2988 wrote to memory of 2292	2988	iexplore.exe	30
PID 2988 wrote to memory of 2292	2988	iexplore.exe	30
PID 2988 wrote to memory of 2292	2988	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_36ea6bb89543ac2310d0ba15df3caaa7.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2988 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2292

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12

Filesize
1KB

MD5
c9be626e9715952e9b70f92f912b9787

SHA1
aa2e946d9ad9027172d0d321917942b7562d6abe

SHA256
c13e8d22800c200915f87f71c31185053e4e60ca25de2e41e160e09cd2d815d4

SHA512
7581b7c593785380e9db3ae760af85c1a889f607a3cd2aa5a2695a0e5a0fe8ee751578e88f7d8c997faeda804e2fc2655d859bee2832eace526ed4379edaa3f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8

Filesize
436B

MD5
971c514f84bba0785f80aa1c23edfd79

SHA1
732acea710a87530c6b08ecdf32a110d254a54c8

SHA256
f157ed17fcaf8837fa82f8b69973848c9b10a02636848f995698212a08f31895

SHA512
43dc1425d80e170c645a3e3bb56da8c3acd31bd637329e9e37094ac346ac85434df4edcdbefc05ae00aea33a80a88e2af695997a495611217fe6706075a63c58

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
205bb1f73d922a24f9eba6f536144669

SHA1
10ee7ad750158069a098dcf2ce639871e80b35f7

SHA256
126fe5debd5f17a352b55aeee6c014237eaccbcbc79dffc5385b22fae3c78244

SHA512
dc8d323e9f85028f13d9e066ce6884256fff12da66efa8e563191c4373e68a1a594ebf73bb32f61681cce298dba03acca5da0ed59e3dbaaa3ddf2748e487f4bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
455a31f757853852f6039fd36439b7b3

SHA1
79fb006861c3faf75e2f651ac4706189fa628bc8

SHA256
5636f50139bec54edb90b6d5dbce898783a3d7ed0e4cf82201a145de3200bf00

SHA512
0c788acb49b1f650f22f183282daa77d7ae0eb5a8c14763d9ce2a80ca3de0c741a37e99c2a2ecc43125db350fcead149a9ca8cc9cd3ce723ebd58a9485081220

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ef8decc5a69fd6b636fa64ab337974a4

SHA1
1c67883df8af03940cea2d27a3445967e12d22ef

SHA256
4b9b7e24a734265aefa29c39ac1053b5f06b92c71efcd0ef1f333db64f108da2

SHA512
7477fc34e8c39c052af0b69dc4e9937a29308744dea080541bbc8bb01c31a8deeedfaed1f1d9a4bde165b0b358517c8360604bff4ff778413c177309c7a1be18

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e59b3c6e041ae873baa550577cc71f1b

SHA1
8cfa474cd4d2bbd8838434b309f080f3fc9b0c0d

SHA256
69de70c2889e6ffe78d6a8b67717b99d48e0cee5253aaaa3f55eb299e27cbbe6

SHA512
525b66bd6b9c3c7d9cc54dc5a959621cd3e792201c28c75aa56955931c5e3e2838d3ac4a46c8ec03c18df13c8d4e88f451e69f25142346abec042a94e6039c15

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6bfea6285a88bd9fce29740367a6ad2a

SHA1
c585c0ed926715b2779f6b3d83133b5062253cb4

SHA256
ded18ce1b0078fbcd99ccd63e566f6afdc27b315919a17045245c8d6db01c37d

SHA512
dcbb8778ddb75962d40aa337dfef0a0f9f5edebe01d89cdd6b96d0f6628c9d13d2aeadef04266a155373998c4578fe0568ee5e2b2177a354a215a12ce6d2caca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c43fd2060148659711745416013c812d

SHA1
2293cc901fe4b14f3a482900e8dd0d79e1bfb40b

SHA256
132f43611e4cac63a3573dccd7dd12de6e19904cdb9a58653022176ede92b744

SHA512
2763854d24c2f86f011cd86c575c77701abd608586fa9f0447d4b2da01996f0e66f115675098a9a478df1aae12d4cdc3187d7be4800058d50db20d85a1ad3b38

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
70feec8b61f9fed80ab62295a0e22a23

SHA1
cdae3be3a972161541451ad4de54db04e16a5699

SHA256
dbc927f086fb0c16fe095ae5f15519a32e58eaa0ad3a4c365ed9030f75489def

SHA512
c8d7f2f6e093df669c956259b549ff8e51f103ba341e45fcea12ad958d7831c50112e524808347827de3f17a723c0601cf641df2f849b161ab587424e3ed4975

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
232c60d2b36f0ea238585a410ef4e044

SHA1
2bca684bec3fa30981733affd881b40f55b36973

SHA256
6c47fef84cd1ba8d30a6be2bfbca42520c8b9a2f06439a9625cf63f9c31de9ae

SHA512
de3d29094cb0c8aea1ccd5dea9f89b3fcda9bf3309e00a4378f11507809af0f06ad349d1e4941d1717ccc3112f0b23abf2bb4a03b7dd2b3f4f9f193c879310d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d9bced0e74202f1692df398dbb7f1a0a

SHA1
8646c9b95ed0efb7e664edd1bbc316836af6bb21

SHA256
cc97ef989bdb58f2dc427ecca1504813ed59c3a2d622acbc2cdd8c446c289995

SHA512
e0899b90123f83367a4c37c878d69e80e850dc0d2d579a6259cf6cab7e644f7023aed70f94f7f6b229419c70fa40489942850bba90ca80470c5240b42f94e23d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4176db7222f9a8efd324eaaec41d23f1

SHA1
5aaafb97babb5e36b7269e85451952b77e75ef12

SHA256
a6ae9c2186f3e5734e944a4c09f4c28f11fb33e85eb55b5dce6ebb58f665dcf1

SHA512
8b38db76f54f8ce842580e163d3b5b73cdf56aa8a37082fd754312f50146ef8f43c378f765fb8bebf4998ec5d90762684687a45a1c970cf931894a563050f6d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0068abfddd632a0df34c4d85ed3395e0

SHA1
0043d0c4345c10983cb7561903e89cde0816a9bd

SHA256
79026a476a9f84d66b1e26278513b2b6889887aedb9b80f66dda6284bef1f8fa

SHA512
84c1602283b11289de3e9827d99f3be9e64b89a6a56d6ca2e0b493c059a9aa0b6761895424bd81eea97cb5c424b5807d47419069990ae6241641f78a3f36c16f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c7ea33b61c8a1ae406d0917aad81c8f1

SHA1
aa73a5ad90f6760a722c08f226400380881d1a71

SHA256
8d77373f9fb6e1feb9b9acac7b933db2b888898c4b775778dadfb917b060ff4e

SHA512
6330a538824143414d2a156651e17c49228afe6ba486d78a3982259b9045d2d387ab2b508ff7cbd34c4701560b3ebbe86705f186e59886e0d98896ad7d010834

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
52cc1570220572f8dcad06e5b231187f

SHA1
fdddbf27acc11a6786fb60a3cb0a53a4d122a342

SHA256
d91506ea0fe2c2d7c9d1b530d0378f08512d089f483ab5637878519a311d25b3

SHA512
2d18674b2a5ccb86ef19861b213fd1fb1162c51045ff6150ac56b8bc2af7b5247af9fd1efeee56bf0459b611ab15eb1e10ac549eb6be93244f5ba1771e8f5ccf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\L6J4GCMD\f[1].txt

Filesize
44KB

MD5
c8ffe56c262b7d4a68f1de4e97f2f537

SHA1
4c01fe4b299d93540cb895cde3c77302403dee78

SHA256
945317f4d7d9c9026c33832f5ffda54fd94ee91e65683a92e4ee5193dc978e41

SHA512
cb065b626cada806e6f98a13ede6146cb7c0dc200b7b3bf47a26b32f3b2c5f70544378cfe4b73f3090d59e73b99f746dc6006301f9bfd47c2e495c9ef2786b1a

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabCB1E.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarCB9E.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit