socgholish | a42318c9a1ab048a60671c800c5e378043d0f1d250c2c01fc6aa8ee88a0a28bf

Analysis

max time kernel
117s
max time network
137s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
18-01-2025 10:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_a74efc03ba79b82ddda9dc69ff632fdb.html
Size

152KB
MD5

a74efc03ba79b82ddda9dc69ff632fdb
SHA1

c00321b8c49ff9ace1b0d0cf441a81572cbf2670
SHA256

a42318c9a1ab048a60671c800c5e378043d0f1d250c2c01fc6aa8ee88a0a28bf
SHA512

064102cb55b813450379fd015f8d4bf9d7106c11fa4f3c34c4096759107e95e8c23c1f5dbca375c8f58440519bdcf8c2d9b274b9d7b698123c5b5b600802a279
SSDEEP

3072:1t2iEw026YMGSXnVv+Zz+IU+wP+6PdNSgodvhqX19gN3ho2:b2iEw02l2+p+b+6+Wfu

Score

10^/10

socgholish discovery downloader

Malware Config

Signatures

SocGholish
SocGholish is a JavaScript payload that downloads other malware.
downloader socgholish
Socgholish family
socgholish

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FDD344B1-D586-11EF-A059-6E295C7D81A3} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "443357992"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2252	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2252	iexplore.exe
2252	iexplore.exe
2164	IEXPLORE.EXE
2164	IEXPLORE.EXE
2164	IEXPLORE.EXE
2164	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2252 wrote to memory of 2164	2252	iexplore.exe	31
PID 2252 wrote to memory of 2164	2252	iexplore.exe	31
PID 2252 wrote to memory of 2164	2252	iexplore.exe	31
PID 2252 wrote to memory of 2164	2252	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_a74efc03ba79b82ddda9dc69ff632fdb.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2252 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2164

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
8e552cedde6e51618204c24f43899667

SHA1
7a92da0ded3192d0cac42e045f97fd10dff716a7

SHA256
1d0a21e2812c15638c67dd5718edc07b9e69f976b17a94934fb0563a827ced81

SHA512
cbb9bbdb0b34b6eec43c319abb1a118e8393529d5aad4f7a52252614064f0d2c01ff718d3affdf262e829559a40697d50f5c6f0a4b4637736e7a579a80009936

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b021f2ca48e9523a466c5b6e7f522c8f

SHA1
e3d259f1b608af308a767ea9b2bb8aa428db61a8

SHA256
3b090582aa05016cbf1a20261a29b7972b4061e3dc424582344c70626d943366

SHA512
25177a33814f1e079776e3ad637ee7ef4ca12f10b52ab897fbb4a7e25191cca857e0502833bea1d3dd438d3e8b670410c6cf6920715252813983b3d3da4a709a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ea202fdfec799b3f7c427b794bdd3782

SHA1
359ae5910bfc66efcc08a605e5ea1e1a103f9cf3

SHA256
a2815cb58b6f7c9b51b52c18b27629eca79296b3b9634cd3245cb0293be6dc9c

SHA512
a6d6a4c183858181319f5800c9efc2a39618cc03d7109acc1a7c252a656034555788d099ca95c72c9bfa32dd32e30291775789271b91549d53459963161d630a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3a78099e81c4cd32fe91fa3cb7038c85

SHA1
9fdd8a6e65b0ab8668e01f26a33533f7d2ea0112

SHA256
07d901635dd77455e37e39323fa0f96b1ced35ee65441f8c1ee79d898f0e3a9c

SHA512
99f8d3119131cf6abdf408238b39dc24059db4c6fae5911904cc7e7223338724e5976560ec2129dbd2655af221a70c74c21fa7d802e6dce99ce7f4eaca1b928e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
17e13a9f23af7af567b3c75f4d2d6af1

SHA1
3cafe0093162d847235901a97116ccb1bb237cb1

SHA256
88f4c172ae418931a83233b50f0db16d94fe0a0bef0a501db504402f0ad78697

SHA512
6060ab6c715322705530505fac7a148cbc796116b75b377e076aaf2d8dd699c900906e40b8329f870e4fba9f2dbace5317205bd205d37c71afdd648acda6be84

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
085d3326f40d4b2ee209fae31a95a79d

SHA1
5177f4eac8f59e3c7c85cf54b37a85c520b3f258

SHA256
a74bb8b758813736f8c5a189e87daa84614b27fcb6892316672ac18e0c28853b

SHA512
b69aac0f9dafff0fc6c2fc031e206c1d09909eaccdffe7ea038434cfc1e602418abb31a53e3f46f4cc5c2bcc4a66ddf6d55a5e9ce368195eb8dd4a7ab803fdd8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7881904b832f086aa86d66ee5af96036

SHA1
a7dc4fe1ac422fd39cb95569ba6bfdf50e79d3c8

SHA256
e5852afcb7fa6173357827678b9055ac741f02bcc0368f9bca8f4ca818619f61

SHA512
3da1ff53daa511e15d955aff9804b13a162d02027350f2e8826d8f4c733b9a9108851836c37ef03c2b29a7793617867963cd1a5c7346755b8ac19dfd48e1f5db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7bb51545b63c35ce773c1ec421134536

SHA1
6fef231c735a189cd6ee6abcda9bdaebe17c39c3

SHA256
c4272b7595a2c45f85820955df21b4fc28391bcd6a950add79cb3d07e889333d

SHA512
abfb9d3221ba6591265ad53f56ff158380818e6a2218135f5d158e24a1b21009e08845e8f339d3ac05602548a2b4d065665bd3920eff7fd8a8a9b87c4e1c7b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0282d4843f9ceb2f519aba028a7c0f4d

SHA1
90e5e675e1537f2568b1fce525acb45acfbda9ce

SHA256
958b9211c24fd278dccd7fef289e2f0fa320fb2bb1fdd92a5ed109d22ee6bc47

SHA512
59ef46619d7710abe892625618b66343a5870b47b5dc60227a13f7f99f0a3aa38d445049dededd592007d396dc317ccda713228083cc40799be38d46a5c4e0c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ac2c597a67d61bcb7e98c99d208b19b5

SHA1
4f11842ea58f0925f06c4459fe58d702508e946f

SHA256
92ed5916ed29967812312ef84b134f13b817bd921994022fa434a91fd4b61085

SHA512
eb27960f2eddc688409dbf5171ed612ae9ff368f021d62a7a5a5db47b29c88badc06ca9ecbcc12522c12325051dd08e29a127dd4b5ddb6fd43ada802e08aa4a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
908e6fa87b326edf3b32eece3c60f29e

SHA1
24d3820752a43fdbf474fb2d87594a05aaf5b6c0

SHA256
01adaad296bdff9ebac9914ea24d490a3318e375eead209c2138601bbe87edde

SHA512
8f3b14286d164411f94216a4388d227abeb29d91c85cdbf65a53e0def37025d7dd7b390c2f357fbd17c34001a8e827f7247a363d3ba0eb5a92a077dbe1c7e866

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Y8UFEBH5\f[1].txt

Filesize
44KB

MD5
c13f830098765896e6b479da9d5bccbe

SHA1
db432ad58c9ebc9a94f3abc743be624bffbc7406

SHA256
0533920372800e5822b153d3365ec5dfff49a68390ab6480dd8c569d7d259c92

SHA512
48d86b2d0a3f519372e3d839fceacc0e0e6e70f402295452d70c40230b9f0eb0bddc553434643a05b8825c0a9d290d00f7d5462bf537fad668e5e99b7daed512

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabCCFF.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarCD12.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit