socgholish | 4f3580c960440ac5a20e4e00fb0d8082bdcc95825a49fe53626057d21ee4dcce

Analysis

max time kernel
119s
max time network
143s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
15-01-2025 08:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_5238d85b5dd24583b0994e6c9ff29d48.html
Size

76KB
MD5

5238d85b5dd24583b0994e6c9ff29d48
SHA1

f64751c71aa303744f94071d2ec0c73ddb8e10f1
SHA256

4f3580c960440ac5a20e4e00fb0d8082bdcc95825a49fe53626057d21ee4dcce
SHA512

d727bb1d3754cd1e1de3168f378cc845254b772c060dc46776247689a8cda3a1d1d34f656e4f56d866f608c01e932b6e58a17d6eec733376198f78da4aaf7890
SSDEEP

768:KwP3PkUoTxh3t/OmC0f13bI0Idww+TXop/j4IUm0/Mq8xLIE2ItDcoF:13PkUoPtRB7wWX0/j4cLIE2IyoF

Score

10^/10

socgholish discovery downloader

Malware Config

Signatures

SocGholish
SocGholish is a JavaScript payload that downloads other malware.
downloader socgholish
Socgholish family
socgholish

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4DB2A3C1-D31D-11EF-8BDE-523A95B0E536} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "443092697"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2904	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2904	iexplore.exe
2904	iexplore.exe
2892	IEXPLORE.EXE
2892	IEXPLORE.EXE
2892	IEXPLORE.EXE
2892	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2904 wrote to memory of 2892	2904	iexplore.exe	30
PID 2904 wrote to memory of 2892	2904	iexplore.exe	30
PID 2904 wrote to memory of 2892	2904	iexplore.exe	30
PID 2904 wrote to memory of 2892	2904	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5238d85b5dd24583b0994e6c9ff29d48.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2904
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2904 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
d7c71666fb9791ffa60ffda920c0fe33

SHA1
e2a846fcfc1f61fdb85d0ea533e1a4815cf9779f

SHA256
c70a9112637ad785bb5ab2da50f0a81bb30e356bfaf9e457cbf40bd08438bcbd

SHA512
35e870cfed5369d1cd7dd1e37c6118d615f5626704cba62c00408c73ec35ed666c24309476f83ef046c2b92fba0466958ec33041d37bc8d9d02940161af7c530

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b6fc0d305319328fd8eeb1a7065c63f9

SHA1
c85b2eb0d9bd0c0208bb624af9d713cc56556001

SHA256
8fb4ae6e6065640d234e64921fc38d955e754c8c5fc18c3d9c7289974b52bbc2

SHA512
6acb4cda6b16bda03ae42f2912c6c3eecae0d465661547cc3f663521553f82db4e58141278f7303d496fd64b09e9885dff626b0a3f18c4018eb983f8289b972a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c697e728a302415037a1ea72e47f1711

SHA1
ae8fe53c2ba0e57d32c100fd39075eff9d2a0853

SHA256
583f491ac7eb13c8dd7c44d7dd90c904e82bc32f58be8b6f13c54e1d3d6441cd

SHA512
45195e02202a6dc9b3d94cb7035c130b011bbebb23d27aa462508e216d04663f85d10ef36f8ba345f4a69f3795d722148f424c208a71326610518e62fd085cbb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5e2f9df32a7da1ae4fd585562fc4cfd6

SHA1
28fded44314d0061cafd94fc46d2639f0e3f2a22

SHA256
25a99ca948b773360f1ed69f121077dd0cae690ede3d1cf069bc769b9ab731b4

SHA512
e6f8134929dd10ae566d0da461444205fdbdaeaf177767da12974977e99bd041403c68982724ed202e61f8b1a104e31406d7b7fd2ff9b5b8a77ba8152cccd68b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5b8d32726694491b0236cf00160c642a

SHA1
5652cb1ee85a8a7b644d0bef097a0c87ae12aa4e

SHA256
d977927a7af168dd0bd033fc07ed184bad7d89d88a22bb3c9700f949d5e28220

SHA512
b4a446b2ea426fcf65f5d800dc8cc7bfb3ed7eb9097520d671fc8b281241197b04a3e031654fed9bceb07cca65770e6618512f76fddce08d1f8b05c482c2b810

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
de93ea3bbcf19cf095abe378a540f49e

SHA1
c285a922ff5f621f22f787a731f5fd885f338175

SHA256
169c1f249dacf88ade115dcfa789fbebef0dbab5418884e526beb012831698f0

SHA512
2e6ca1052e6d5d4fccc2a932759fdeb701ef49ba3c3460a96965e4de987cd029882f8a890c292f43cbc33ba9c0892b93959dcaa1c18e66463850774b814b8d54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
516e9c59f4c3b7e213df86d0ce8aa7ba

SHA1
1a60b31a8864da54c8769976002c4ab445b7d80e

SHA256
ae345b52cb6b2d9de0f3b4a370415071d85e093566bbbbbb57d2535bd30209f1

SHA512
07e40eabaea9130901eaf3299b194a5e0f80a11f2946580e5d7ff7326feaeaebdf59def7fdc52e91bb9a5970922cbbe1bdf254d69a151ed5109f1c6293569bde

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
50e1317aa67801a498325ccb7b76c640

SHA1
5a2fb2b4025f09b94ac2267af314e85db5da6737

SHA256
fdfe9305623caa80c90934a5ede381bee6cca86972a5318f18a137917f72ebb4

SHA512
9af7fb16ca30a088ef8030d8db254f79174ac34ad5ead21239a062e7616625ed58b7ab6314cb533dce61e973332ae99bbe92689d1f535518ff548743b000b9d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ac97fb9584dbe67d79db1d0f0e9ec48a

SHA1
348037a811c1388e7a8af5ffe2c7562372895b68

SHA256
684670ddb3fc269b6d2b9aaa88618b012422080a8fad472708c929db06e2ad8d

SHA512
8fcdc3d99430d98f164eadc11a8e31c6823c7138008780daf4454b9f5cf51ad5c8014e42b576b0e9673240bbe927af3babe4395334004a253645d14d13becb55

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c941af65669eadc828784971d26f2b5f

SHA1
8438e78f9cd5c346a7f26e7f32331c4801be4042

SHA256
390270c9d9c46c7903fa8088a61d345345c79c497901310ffb56921c355a190c

SHA512
f8d1434127c69a2fcd598a66722d5869af73505df349db19045a98fd4ceaedb9f0210649319d999027c721a83b3914d5b68fe15bbc864d551266fba16b6f172f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0665fef5488a5ebcc04ed708347e369e

SHA1
f762a054b58c7c9024f88df8e2eee6bf8fe9cfc8

SHA256
d9f1797cb6791e9eafb6573ffe2761da5d9e8edaf4188796d76a7347abaaf07f

SHA512
16c7124a1e033a856ea1a32dd32392151a242eb59c5be51aa4928f4061c7868c90a3e7774040dbb483e53b184f46addb9ed2188171caedd9971c98f209664a28

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2544d355ef8314050aa94c34a34babe0

SHA1
36996cf79c021ebbf0998f815f4856f78557dc45

SHA256
8072176066f28bdacba4598d8cda464514a9bdca3ac4450343c6f419cf80cd5d

SHA512
db688fad7c0ed995b97673bb7650cf70ebe3ef23aed62a88979bec71720563d67f889da305a83a2a2ace7f505f915654a213124830f1b0b30907966c9808e2c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
caeea411bce32b8bef55b8ba2a12829d

SHA1
b3aa6c5a1d635b4c4695f0c26718037e60aefee3

SHA256
d77abc33cda51a2af3f8a99b1867e4b532b77ee2c42f54483cbb87bd5b3252ab

SHA512
00f67d8d9134d12496025d6b6eff11c611b1bc511cccec2be33641a6588c0d59a04fc51ba2478b589a0807fb74b0ef2f1aac601c26c3c2894f09f221e6026da5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bd7e23215bfb72b404d33804b2138b67

SHA1
373f0558c32f0e7bf5b5518d89b86d5bc796df0d

SHA256
5fb26b963315a06e369bb74713427cd6beaa502bf1f726183fdc71ee1daa87d1

SHA512
39e0b95e07430768111587c14d0af0f6ae74fd3bbb3860f36d3c49696290ff289432a65145dd95e70b0255f2bdcdfc86f9ed0ca5366a37c9311fae8bba65fb7f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
909c074d9dabb63da1162dbf669976af

SHA1
88feae51dc7da97653521bb449d2bce51552d50e

SHA256
79f6af92e5a5ccf9827fabcac9fc1af74295748014ac7c32204ec6f25dd69d3d

SHA512
20fdd8b171cba5e10fb77d75a041abc6c4e295fb9ed61dffb6ad269057f51729a785e762dc6d18bdd64b22b06be53b4a021a04251682aac2c5cb0f4d27fe0a35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0I0VVMWQ\ga[1].js

Filesize
45KB

MD5
e9372f0ebbcf71f851e3d321ef2a8e5a

SHA1
2c7d19d1af7d97085c977d1b69dcb8b84483d87c

SHA256
1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f

SHA512
c3a1c74ac968fc2fa366d9c25442162773db9af1289adfb165fc71e7750a7e62bd22f424f241730f3c2427afff8a540c214b3b97219a360a231d4875e6ddee6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Q0WBLVJY\f[1].txt

Filesize
44KB

MD5
3d98d6e4340908c9410ac52a218c419e

SHA1
119d4f7f4e3e185b7ee9722d336aed9ff9d317a6

SHA256
939ff7c40a1fb8a6e21e7565198b9c7d89d3181bd6fe6ae0b71495aae5e76884

SHA512
ad7426d9c8278d6db807214a62e39a311cfc2a8d968a3978c17e452942694a74c9c0911d9081e84513aa4ea07cf2d3d5a3ce374c0ce7dffe2bf3d7491821ded4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8539.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar853C.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit