socgholish | a05a7fb57309550c9c56366fb61d3e98bc93bfc5677f4def64c199e06e492466

Analysis

max time kernel
122s
max time network
147s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
15-01-2025 08:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_522ce2746bb6bc9fd71c7c69d7765cef.html
Size

84KB
MD5

522ce2746bb6bc9fd71c7c69d7765cef
SHA1

f1b0b3484058767f43aa782b5f8b51d0286593f6
SHA256

a05a7fb57309550c9c56366fb61d3e98bc93bfc5677f4def64c199e06e492466
SHA512

292c632a25d023cbd666c2f60eee312410f4f85c7c7a744421858923156d5222894433e0c3010d540a8371a80decb4eb1d53ce9332f109af007c2408d12c1fc3
SSDEEP

1536:DC/A/L5ETQuahu+rHasslRNodlhfR88CB3MrXJr/qPPwGcUTZXmul:DCA/4ahu+rHasslRNodlhfR88sMrXV/U

Score

10^/10

socgholish discovery downloader

Malware Config

Signatures

SocGholish
SocGholish is a JavaScript payload that downloads other malware.
downloader socgholish
Socgholish family
socgholish

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{12B9B741-D31D-11EF-BB15-5A85C185DB3E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "443092598"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2744	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2744	iexplore.exe
2744	iexplore.exe
2792	IEXPLORE.EXE
2792	IEXPLORE.EXE
2792	IEXPLORE.EXE
2792	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2744 wrote to memory of 2792	2744	iexplore.exe	30
PID 2744 wrote to memory of 2792	2744	iexplore.exe	30
PID 2744 wrote to memory of 2792	2744	iexplore.exe	30
PID 2744 wrote to memory of 2792	2744	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_522ce2746bb6bc9fd71c7c69d7765cef.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2744
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2744 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199

Filesize
170B

MD5
2e5e2af2cb30581a9632b6c93ccb3781

SHA1
8a9fce52d118bf0a646a772f6da81d32a0917c86

SHA256
f8c626c477df8b249c2811eaa747aa2ace1d35b33d1116726ae98875f9881c95

SHA512
eb2c00336ae763d400075d8137b14d297b35905e921a632b9e5430a372b5ec6a4e2a5f478aff83d2ac0e08916e981d89d3209cad51b288e4900334fcd0addd09

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
ffd116ecaf19a30002a964bd4672f576

SHA1
869e2cee970af78d3cae4a552bff9a17aecb8509

SHA256
ca6532d9a33fa43c691e879be04d93b6487e5c65aca882ef88dd97315072aa60

SHA512
08c6b1064d57830d1db708715ca4f4e42e95f06beb116238fa074d1aa7d8075012784fe2ba533db44742fdd52539f6e1d74dd4f608f060995316e957b02c1ea5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
14214d1b4fd35974679444662145a0a4

SHA1
00d12a83f0967eead07af9fef2af27bace836f6d

SHA256
e4af2789f9dbcc63139b26e47d0577aca75756184ae511f530e259e5fd1d1223

SHA512
4b74da6bdbd49901389d2b1c029574b77bb9b0d975c92c4689298490ca66e360501ebb69f816ad667d1a44c16d36f4fd665bf9a4a3e009b3b20ea2a8c6cac37c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e428a8ca980e05e371cc8f7fee0f6c4b

SHA1
19bc16c16400e88cd801ecdca42021d6d6dc2a20

SHA256
f7cee8422cac4194151be10977d6244e7c0a0356ba496a6be2e267efed8f7a89

SHA512
7c84ce4eae592e1858668310fd5688908d58e54eac1a13193b3e5a0bd15a2ecaa48e46531183c17f29d6308def7429e9327c2f8f486fcf3019b0d1e6942dcead

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
869f360fdf93549b2b3c561724edd2f2

SHA1
e99ad41aabb20d1dce85d20ebd974817f3efaabc

SHA256
0db3a25deb115adedfc886387343a2d0cc92e61d910e9423ddc70e3129c99ece

SHA512
4fd6a5c32ee7559c908be04701b533a6735657a883f39727bc31a91c309de243cc8c1003d2aa6c159a36afc3f3d0670f6b051a6fae26b7c377e4cec985ba33e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b6adf14f0686698fabdeb97c2f52863d

SHA1
492bcc82fdbcb3c51e21e095b660054a48c528ce

SHA256
f0e42ef76891bfc24b0b7006a093f493ec2e4469db961b3b1a566ffe1465b530

SHA512
eaac4d5c2b8924107a2254647ac49078455ddd84b53bf729d51a5fe98d253cf9f8d90a602d8dc2aec055cc38a14d6d2ffe359af8d9a87d62811ab3e4f2d2bf1e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d1c2f373b5787b63bf276e7e840cc29d

SHA1
af200aabfd0d6f1247d1d813db72fcf30e85c432

SHA256
f34d821222832cfa5fa213ba9c3f64f856bdb29a2ac6e75fdf72c2107ea93dd3

SHA512
30b91b3c9752c730c85050aefd255e38d60ee3a42e2f4831cfe29ff7428484af650f266068e7041ebaf389c71e802e69cdde1c742f166d03978fa203f7dc86fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
70824a03416571e3cf49dbe8cd23252e

SHA1
351941f1ee587cccc36919de5a897578f3d6eb29

SHA256
394bbd863ba3f395845d42d1255a3977f01b29fad85fb352f07d2ae90c596ef8

SHA512
ba5859f862acb6a136743b8173e492d5733f4e20fbbcd3d7c4408bea2c9e3f476613f4bc30141ac24a33c7d16287eb11d3c063080ff36dce360c134ae50e8bc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8a7780c4f53376c2b2f7fd269318a948

SHA1
65caabf807ea8c3e2c60f70a70f2cb0118dbee74

SHA256
68f92d3b471843e48b1f6bc5b2507ad17f995245bffb86d7339367a0d2da2feb

SHA512
ac7bf9888400a9277c91131797b0cd1e0642057553151c655e265c9bc508cc5d8753ddbd9553853eea91cda28b6100ac69fbe34aa0b1d8ab7352d513c271bd30

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1f7512274c7f88db0d5a92ffd85e21f4

SHA1
bcf16388e2d0041b60469e4120c42d3c60c19cae

SHA256
9e89fa109586d0887eb4140cdb1b3f57e3c407798d88b40cd111c9b2b09ebe06

SHA512
ade8c53bd6d77228f9f3f07108eaf8a2dc26d31d90ca857ae5cf71d12e5314951b302f642ff4037e5efa08758ef96cd43ac9bbb5dcbef7b3710e8eff8504f4a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a3bcd0035372cd2d2d6bf3fa0c595e32

SHA1
883b6d6c35a4f0b426d6786d17593548cf6437b9

SHA256
3f044c7f9a2ad6981a1f41a8b6a1658407ca931eabad4d5a7713d703763e0ce1

SHA512
635c1b4cab806abde0174a23a1c2a001cd4b7b1835816aa61cf0178f6f994fde36fa3f517910fca2374e13b0e2bc269b8c3f8831707e87b2f8e7a17ac5eb392d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1a903d2937b585d6d468dd321568ae8b

SHA1
dd673ea1fb2584e4d68f5a4dc03149c1eb02d9be

SHA256
863d051afa101554a2011580c09c03c37fcc5c8a2c53a6435c1dac7b2f926385

SHA512
fec09a7debc3649e097b8f261f2d7125e7f9e1e9b188006b8601992a7288e1b73abf9435b01950f9e928fedb0859207e3276e833b9aaa5a5f159b9ef82efab62

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2b4c15acf207cb7f2d03660cc33422af

SHA1
ad1352891731e05ce2bd12c945f6759094d81561

SHA256
d0b6053f715143b224be913f561c9045af46daea02dcb5535d84b5dae8358ee8

SHA512
368b5c1ae6283bffdcab4c5cb8d71f692cb04ecab938727c94d0db40c6f4ad43b07abdefd5ee8c7121ba810b0eb15542a68846e02f0433103ae8447b48c4ca7a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0932da2928bfd24c57f443f94e4f03d6

SHA1
9bb1b86752fc1c3d7f4568354dae2675413ea6a8

SHA256
32eccc9e3857947de4711f4330b647d33fe727b15eeca07e30a34c5acd75e2ba

SHA512
ba956ecee9c08a828d7b3c43162cf8c8f9194ef042cd3973bd26e7df3fd4c7fdd92f0065bb0042fc5ccc760820935456447ab2b9adeff2be4f29f762ea2e9d69

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
4613a598843bfebbdb1a633b02bd7f28

SHA1
110ce7711d46482b777a1b408b4314a6e99d9a31

SHA256
2b399d9a76b88bc29076ce424253758d321bec7e329d51aeaab1e23ba045c152

SHA512
d599758518e829b816bf7f0e91036786a3a498dfcb6c59927a288b94b2251ec3aa9de53116512a59e0a0b8f99ded464226a969830f508d5053b0607f72ce94c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5840.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5843.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit