socgholish | 69cb22898161887236131d71cb90931d2660da344257b1e9a0619050165c37f3

Analysis

max time kernel
137s
max time network
142s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
15-01-2025 10:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_54085767d17ed6d7ea06f9dc48dfe19d.html
Size

88KB
MD5

54085767d17ed6d7ea06f9dc48dfe19d
SHA1

46b9264bb64bfa1fdd15593090cf13969d851e36
SHA256

69cb22898161887236131d71cb90931d2660da344257b1e9a0619050165c37f3
SHA512

62c947c70e831e905849c8ae7f8cda38f826329f1177f094102a10d26a2375903fb698b39b836f90116db8d492ae832db77b95676ffe8f2702c74fe46ea769c4
SSDEEP

1536:KC/A/L5ETQu0V9Mk+RHasslRNod3h3R88CB3MrXJr/qPPwGcUBZXmYx:KCA/40/r+RHasslRNod3h3R88sMrXV/8

Score

10^/10

socgholish discovery downloader

Malware Config

Signatures

SocGholish
SocGholish is a JavaScript payload that downloads other malware.
downloader socgholish
Socgholish family
socgholish

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "443097724"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{020591B1-D329-11EF-8AE4-465533733A50} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
768	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
768	iexplore.exe
768	iexplore.exe
3068	IEXPLORE.EXE
3068	IEXPLORE.EXE
3068	IEXPLORE.EXE
3068	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 768 wrote to memory of 3068	768	iexplore.exe	30
PID 768 wrote to memory of 3068	768	iexplore.exe	30
PID 768 wrote to memory of 3068	768	iexplore.exe	30
PID 768 wrote to memory of 3068	768	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_54085767d17ed6d7ea06f9dc48dfe19d.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:768
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:768 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416

Filesize
1KB

MD5
55540a230bdab55187a841cfe1aa1545

SHA1
363e4734f757bdeb89868efe94907774a327695e

SHA256
d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb

SHA512
c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416

Filesize
230B

MD5
515894b57b73922593b0f73a69da79c7

SHA1
b63f54ce17d485183f74989540a1b5e2e9a36856

SHA256
84f451a447efbbbae8dc8c9de66c606f74d212d770e9b7832fbae1824189ba62

SHA512
737f6848dceddac5095f7a833de591ba1e3f7ee77ffaa86fb54e11139a151186a622d32a94b8e013218c19cd00a84ac8dd437aaa81c1faacdc8f043e1dac94dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
9f015bc77fae9b37dfe3a47baa383b1b

SHA1
d99783bcb06a13e67076803cdd9a44299a5501f1

SHA256
2970a276fe3499b8079e822e1d1a238631912bd31cc0d523903425e900991b6a

SHA512
6802fca124dbbf535dd396b36bb36e22ee701336d101189f47609ea6f779ad823822efaded8646b0d6728e10788ead5e2ddee385936812289144d0b1bfbd3d54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2166c668e48c8e183daab7a6fc688bad

SHA1
5e8efc4ff6c6a86abcfea77a7c6085637dcd2b1a

SHA256
e4b3ff2a352c2b91980bee91deb1c5bb94c8455fad050bf39df7bdc1d788a7eb

SHA512
a9c2059466eeaa1807a91994d06ca0acbc0657a59d62dae0978feb8955ddd3708f8ddcbad6bb1d0bd393b86d8b07a04476978e12ce324f541e6dbad58203e6c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7b179bfef84842f185f12d28abb7f4ac

SHA1
d013dd85a633712ddfa08a776ebc2bf1b884aa45

SHA256
1101ca48c8e49d712402230d900cd79e8ba582ed350fc73c52378601266b6450

SHA512
f25b9042a1e2b616eb8e15de9cb71d2234239a5f504069ea43512358a4ae396bfea210462347383ef591dec4efe9b518da5428fa7531dc5c971873c8d8fa10de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a190f6b9095518ab4af623653d565fc7

SHA1
0ecc7a8df46b4688ecd747d4d0296b69aeecc0b9

SHA256
5142f4bcec1b03457e99673ebb4ad7fc734e7baea93dcb9b727525d634308cbf

SHA512
f449032ae127092cbc3f3ec2c57effee6dece6cf72bc5510ec6e873806f4021045e5a7788fd379f1342818f72d4106e78dffd0155ddbc904e7434d26f4261f62

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8ab8b77f285f3bbc5fc3370bf51c9eed

SHA1
00ddce3df4e0f30f6b7d36dbc1d31214dbd36fec

SHA256
7cb2a482e121b692ab04255e73f806c3a1d7d1d763974906447f25a40c34bba9

SHA512
11afe6e83c27960ab87916cc38739dec0c1f96da31a60cb0246653aae0696e235d6c0af0dec734353c2f5cd997041c28b84cec88b452813ecab01c050d58c695

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b743fef192096a7e7edd47f7d19fe3fa

SHA1
5f5d9ffb53c2080b52451973bbecb222c910521f

SHA256
c9b2324a032cad906605a98a03717b2744574edbe0bf651283f82db4937b454a

SHA512
035cabe2b76c22cc17e5d17c4477618774eea7a3e993f34b5358dd8c9ff68813847bdde2ada62640895c0f833e1a893ac40f5699870f59ea2ca56814c90c0e57

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0055a0338723af6f23d9ab693ff10b5c

SHA1
3807e3c4c74f9a43e9aaf7f63a8b63b6ca9ea289

SHA256
bf44601a0eb8e65928f72bb9e4906f585d6846bc6b56481632e9912a513e113a

SHA512
92d99076d4235d55261db1fbe6ccdaed6904f1a0aa07cac50ab3815fe3f286b5f64e3bef7714374028d256c5bc53f3e39520c899b23f6e23e06f23614edf4c05

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b27d4c757305e54c35d29bd4b1dd2a58

SHA1
073d08ce70b87811344fc07fcb16f5e27e42eb52

SHA256
34087cbf3e8716692cb9cb88c4f44aae07d5a7e3a0a96762980a2dd248e7efb8

SHA512
b50168326026691573dc7905f43b8226f0c5b9073456793bf43f0b3189108f04d41cd5d440e42848a867f1af39c7b717e1a887e9ac621b70af77981600ab12de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e84d4b475951779e94f805adc5207c48

SHA1
d010b881e26480bc042985b9513a7efaae511430

SHA256
04a77bb83d22d6b517453206f69e9de7806f8f1c6525ab32d7fe91b9178aeae1

SHA512
4301b5e927a9ddeafb3eb4e474d93ed77125bd41c7915736f09b2eedb1f617d6b45831f90bd0b3daf80959a2bc06bd2ed30f7fa3fe134587bc3f82355d065863

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1a947d510a75278ebc303daeb6bf768a

SHA1
654f3ac8b8ab97906445ef10dbfb24eb62d2433e

SHA256
0ce297a0f047e92c83d4cb83c84f09e6529630833dd358f03ed390ae207c4d4d

SHA512
8019bd1da6fa9c3914ab9e3743920534cda4d50c00482aa96835593849d312b17d87545327266c063842abcfe928ac4ddbfb8613ba0d28b7c55e1b6c6357d698

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9791faf581ec517ec2d8efbb4444cb51

SHA1
873a209829c4c9775fc3ec1c81823da11896ec8f

SHA256
05863ac2b23860bd5bcea39c76bfcdbf38694548eede17b9aff21c872b550430

SHA512
623126eda3b5d46c893ef8184067b3eafb60f9c86a1b06c1afb6087c014bc75823bea38bc11a3808ac766f075b2db115a56ad353043157a9b34e48fc3c0f9470

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4431f854c30f8b890fd448bf8dda66f0

SHA1
8ebf6beafc013da31d86453c3003d96a355ac520

SHA256
a3b44f646e7dbd4a27e0bcd0328e75c31c041e18a630a2c4512473130e5304e2

SHA512
64ed889de19a5230294794dbfe36e21ca8153f90c36c777b7eb234f6c3771b8da78d4ea1d7f87323ea15305f8d7439ccef1543617a35de0075f77ffe0c5f2ba3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
548c56dc41282b3e23bda87198b41414

SHA1
5d327a1310e543bca622ac3bb9fae993a23ee6a9

SHA256
5507cc97f71243b1ed292d6442e33479c2e888ca35e038d32887d2e689f45015

SHA512
0f5f58a719c69f8549b49a38f194ca81c418f34af64982f1045b485258c5012de62b21b05e8b844a39b177306d18b63491cacbb238ec721cc1608ecc2f09deca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
a61370fb0110f3008dca3446f4cdc1e6

SHA1
f9b70695115da88103218d8b5e2c897be11360cc

SHA256
122896d197f2904962d3a5f55fa22d3548f3697861597f50eafdcd5d782a7c51

SHA512
b3a9919cb584107b41a66739dac938cbd42800f9ff87bd0b8b822772926b3d30979279cdeed0e723e1e8581ef0f94c10f6162a8bc6d153b1106053e191193e83

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabAFC1.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarAFE4.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit