socgholish | 6b8ffd48571e01f5c54a20ec85bfcf3076ef49507acd17aa1a31af2b09c8cfaa

Analysis

max time kernel
145s
max time network
149s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
15-01-2025 17:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_5dc0447a75b0b681be959c7c05d48b37.html
Size

83KB
MD5

5dc0447a75b0b681be959c7c05d48b37
SHA1

3634963dc36e983f62fb55a7d0f0756110568164
SHA256

6b8ffd48571e01f5c54a20ec85bfcf3076ef49507acd17aa1a31af2b09c8cfaa
SHA512

317a3d35eaa54f7357360f7e764d7a2222e2ca9c75177064830e7dd8fd7d5d91dcdc4324f4f075bce669e10a6a11cf4f33feee2731efda9ea009a94c109dae22
SSDEEP

1536:rB7gbmFo15Mj6N+tkH+5P+w+4M+/QaKMKp4uodshzEGnq3FDq/HtGlHSIX2:rBKTLN+tk+B+w+4M+/1IbodshQGqVDqR

Score

10^/10

socgholish discovery downloader

Malware Config

Signatures

SocGholish
SocGholish is a JavaScript payload that downloads other malware.
downloader socgholish
Socgholish family
socgholish

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "443124744"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E7A05F51-D367-11EF-AB3B-C60424AAF5E1} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2076	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2076	iexplore.exe
2076	iexplore.exe
2128	IEXPLORE.EXE
2128	IEXPLORE.EXE
2128	IEXPLORE.EXE
2128	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 2128	2076	iexplore.exe	30
PID 2076 wrote to memory of 2128	2076	iexplore.exe	30
PID 2076 wrote to memory of 2128	2076	iexplore.exe	30
PID 2076 wrote to memory of 2128	2076	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5dc0447a75b0b681be959c7c05d48b37.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2076
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2076 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2128

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
08add271c1a004f0c72d9b4020a1c7a4

SHA1
6bc160c14098153f54f9405b7efb5288244d6bf7

SHA256
04373538b2d52154718fc4827b1691d87a23ba5e19021146c68eb278e841edc4

SHA512
07cc4fdcb5e532b1b4dbd96f16a1510e588d5e7f88dca4486fa4f94a7a0a9d75600369ce6f74b2b169459c0ffc471bec4071bbd17da9559b8b9a548da1a84c7d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
79a948c22fffa300d56a1e297425814d

SHA1
9dfb6bcb90be5fd21af75096732bacda0853b1f4

SHA256
9067bcfb47b2e0e7553cf1ab3c17d83db63cee25acc24a27c4a4d959d5c8c200

SHA512
c5e54a20aa0e2ed0a83b98a00bb889a8e4449dbfd1281f8cad9f05fdee0c2c31601217327ce5d089237dc6987c29efa1ba3a2188880f7600ef681ad251397867

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b3700de7062f54b16659f5b3981014fe

SHA1
0f49b1950b550eee8c360d451f44260e4c5d3619

SHA256
7fca874398ebc0fbacea0469608a24f0ca2b9cf355b6c5c5b333f14a99ee3a5f

SHA512
e25ec7f011947e67ef250f7a299f20cc5fd69d7343d07f369237cb31aafd0cfa1f89c941131ac647a264a66cc889a3ba9d1a15e1601c470ee3b81111467c2af5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e3d9058d29cb7193634f5236fdc86ee7

SHA1
74a4238bed2fe4651bfcc8ef8f9a85578c0adab5

SHA256
5af8c6e7ade3d3faad0d131638504d176f48bba8ee93a853940c503e12a0698d

SHA512
ae4b8564eb2d2fb23252cc6beea63ae82748f05743063484da95253ba27e7bd624cafcb597ec7c43e35ba947306b648468c00e05c243e9f8b5a579259169dae4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5eb11a011d728d7423dbd1b0e9db4844

SHA1
2ffdede0262569eee40ce7afbdef3fdbb4f6adf6

SHA256
9f21416ab1c29eafd92dee5f6aca3167aee465c35879ed1c43c019a71f72bf18

SHA512
2cade6a1f5f0a2503889a27df30df6b6f91a6cf552341e36877df14dc6fe29473c01e1fce4907927dbf8bde0b3ecad8bf32a4b24fb354ba6f886f7534def39de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2e44055025f4550013866d8c005b92b4

SHA1
956cdff2ff03f6dd3ed83e342026947dfda45efc

SHA256
9a99b8c5ea5e0255fb4d49cf619c40694322554156f07e5d8e9080190b56afb4

SHA512
7a038ad6dc42bb725e52711e6e1bbb5bd686ae507efeb53680580ae8f1af071631d6acd5282adb34aa181e643c17ba5dcd309b74a0df5ec6d963a3e314452390

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
de9191e745bb93073f97ab7d8cffce99

SHA1
f15384c53795864ca790163241cbf6e946f8f07c

SHA256
88f3c596988add021c3f7d66e00eb3dc3bd81b130b3b9e24ef905e32d111ed81

SHA512
a19ec5d051c73ef52ac1b10847df9fdc44dee6c058749ea3647145b532e29427d47c92f2d7e9031186caf3191e1ccd203fe962287b69ad1cf5e1e5159faf8002

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
30b7db860051918117d820f9614a9dea

SHA1
7ee05f2b3353f3a1be401cad2a4f8afcdf476c22

SHA256
0abc1fe2cf3476aa8db7dca50b97c4ffc4304ed3fbd7e8d107dbf8b556fa8d6c

SHA512
707887cc0028af7b75f03623a50811351a8721b1f1347b3bbeb639e55430eae1133d2b1428072359f742c227888711b21f31dfd7f52884671d167b181025b173

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
98d96a26795dab32502f46f4136cd45c

SHA1
dec27f390644b4fec7764d681e783636e89ce05d

SHA256
1d9131296f1f59c9fbba4af210a12e04e43dd16e43487683253a8888d5e5dd2e

SHA512
38c0d0a5588b9365a15d607899da929d8bc822f040aa0c1dc51e50d2a83e402d490a9d9e509d9767ebda736c1c9c152aa9e3b6d9acb823742e5a1ff366bcd91c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
9cd1118824174b92cec221e6d97bea39

SHA1
4ffaf9885b65edc12e34a0a4c9dc0d23b05bb6af

SHA256
6b1d3686de28c513e376471077a55a44e1ef7821fbd811f106c988405727bf2b

SHA512
2a5f2a65c98ae0d144691a53eca32fd83769ea5992970b47d3095392e01dee0ca91a115f45faa55814797b0a954537c1b56cf21ab8e1b7f26df402ccf2139b42

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Q4648X1K\f[1].txt

Filesize
44KB

MD5
3d98d6e4340908c9410ac52a218c419e

SHA1
119d4f7f4e3e185b7ee9722d336aed9ff9d317a6

SHA256
939ff7c40a1fb8a6e21e7565198b9c7d89d3181bd6fe6ae0b71495aae5e76884

SHA512
ad7426d9c8278d6db807214a62e39a311cfc2a8d968a3978c17e452942694a74c9c0911d9081e84513aa4ea07cf2d3d5a3ce374c0ce7dffe2bf3d7491821ded4

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabBB94.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBBE5.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit