socgholish | 4cf309cd108b78f22ade9efe900e6391e8a509a98b11af2bd26afbb452e7568a

Analysis

max time kernel
142s
max time network
147s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19-01-2025 21:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_d3c978690fb6e3bee75285cb1b04d384.html
Size

87KB
MD5

d3c978690fb6e3bee75285cb1b04d384
SHA1

6cebf5a287863af4dbdbabdc0224711ec98c7f85
SHA256

4cf309cd108b78f22ade9efe900e6391e8a509a98b11af2bd26afbb452e7568a
SHA512

5209cac11e1f37190967a1019d653e3789543ae862f8fb46932706bbebfe1c8b1da77a611b87d692d83133cc2b95f1d44eaa02e220de18aecff166b610fad8e6
SSDEEP

768:wwP3Pk7oGxh3t/OmC0f13bI0IdTTR9gVVVW6kj4yUm0/Mq8xLIE2ItDcoF:T3Pk7oYtRBmTR9gVVVW6kj4mLIE2IyoF

Score

10^/10

socgholish discovery downloader

Malware Config

Signatures

SocGholish
SocGholish is a JavaScript payload that downloads other malware.
downloader socgholish
Socgholish family
socgholish

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "443484363"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{38DCF611-D6AD-11EF-B267-4A174794FC88} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1808	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1808	iexplore.exe
1808	iexplore.exe
2336	IEXPLORE.EXE
2336	IEXPLORE.EXE
2336	IEXPLORE.EXE
2336	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1808 wrote to memory of 2336	1808	iexplore.exe	28
PID 1808 wrote to memory of 2336	1808	iexplore.exe	28
PID 1808 wrote to memory of 2336	1808	iexplore.exe	28
PID 1808 wrote to memory of 2336	1808	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d3c978690fb6e3bee75285cb1b04d384.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1808
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1808 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
d33023c2b05216f2d3f76c433bd14265

SHA1
e2271aa71ab085a38883178b436221dcbd730dce

SHA256
97e79fb13f1707f8b96e5a51c8f4dbe802a9ea2de08e88afb412a4ab472ee0b0

SHA512
7c25a4dc2f50c572c9d0ca14309eba4175cd03d5a265d1cd4210e1a5d6d21270730bd11f03eb0de16abf0ae237e6c42638a0ded5b3048f30f5d25ee6f9177e24

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
16e28b6e869d0d2027fb81f751b617dc

SHA1
0c599eb958ce1c18aba6632811a5c8d73140f4ed

SHA256
0424bef1dc7591d79b593f3b3cc3dbb95f887e993fc2301cf09c34de26f894e2

SHA512
d2a72076392831132c428cdc12fb2247c5924cebbc7edb46e9f1eb875420cbba3482fb2a6f708d7eeb5ad0be1620c6c58c07f50ea75ff676e441a640837efc5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aefd7a21ca94b26a1800fd8f5d50316d

SHA1
4a931ed503e59dc04845cf6f72ce1f0b64939bbe

SHA256
391cfee1ba3f008c6b457e8fb5123d2a4eca76183969b3d2f620ec1f471d8401

SHA512
00b7ea4245f3a7785ad183dcdc08b26b471e42b41f8f608a027fc6895d59f6a893af02ede741b8269370d1a17ed1f53d999d75806af588c9f3844505e4e9ad56

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4f939e229a9a5d39f8ee13799bac2eef

SHA1
ff90f839524a204b29dab19daf4c00fa900805d6

SHA256
e4f9a34778ce39480373538ded0ffb11223e42576b94f172fc82a6a597f7678b

SHA512
7be722e5dfa6b69ed6169f0bce010f9b935132fd3d12c38f76cca88b4e0a5eb081b6f40817f9987750bd11b206852592b62d8056acad5c9f886e25b9d97f701e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d5c7df868dc1740391e520a2031d7081

SHA1
b0d19071c8e43c28ce99368fd53c634fb780254c

SHA256
2f60321824e02d94f3be8928e420b06aab89a18096ff30f13872ac386327f2bf

SHA512
f0e43c78d0c3ad2bd2dd28c238253421824e2c3a0fe8af9fed39329de0478fb6260b9e58b28a7cfd09dc2413006dcec4a0edc971d0c0dcf19f550354e7b45482

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6646e9237c818806eed77e08287ce07e

SHA1
45d380a247736736870cd0053143b050b5283c91

SHA256
c8af642fef8db1a3fda1200c05a7cbd49f6ddeba128a40ca8ebf475a5c207d24

SHA512
43473342da01fb5950754bdee354f2bea0979d7ed3f50cb4be789e00590c32d27a610583e03ec686dc01d67f97c4d72adc4894305e44b8f8809094854c7b91b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
500ec31b18d5a9cd2d15141c72fc9222

SHA1
bfa41d0ef76fe38e149dcce9697c95d8c71572bf

SHA256
2b2fed97bc75de8104aa46412a47eaa6deeb7e7ca80cb5a616df2786ab7b88ba

SHA512
a4f2198e18c3abfb68916364da44e600cd079758d91dcdffba858e1bdb1f9d7639b300aaad5514c95f81bffce0fca80368e2ed3e10eb36695140f0c214feb4ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5d12ce4c40475470cf0e06749a416724

SHA1
da4407679348eb934d68bb377399f83fd5a1562f

SHA256
e288efd96be5d76a11cd03d42c501ae60716c1804e4d932fb179800a76b236a6

SHA512
f398465c256a4c87b459af004994c405d70c9914fca830082e16520efe00471a098c9315f961386dc7c9805f18c11038669c5b382f4b7e2287bcbaa5c2e693cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
977b66259828f89b49d88de712c02bee

SHA1
ff1122d8a6831706fee9130a45dd523fa9f1869f

SHA256
b0c5708b511c37f1e8d513ca755d929b3e8ba9ffe2f9b03c250329386edaf807

SHA512
51d97e6c7275672baefe8df1d19a2d9a019aa73a311629c1f705f533d1a0b3bb7c657dc30f3552ead8f84ebbc6c30b2f17a3e28a7cd97d10cbef5a8fed912e97

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a2a86b7cf3711894db68894af5be6430

SHA1
86d08c8712ed40e6fab3b13e9b10e8a10518e8ea

SHA256
ed0a3c5730f5c4cc376369db1788c2cdd426e40608367d711ed60dadfd0d3db9

SHA512
1e99b1763612e413ed6f9c297b3ef516fd773a607e0f8265f2112a50c84e49d660cb96cc633cae3e699b471b1606390bb2758961c212a46647b51ce5950abcee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
57e99f9f0f983e2f14b12cd08a8cdbac

SHA1
358c409673bb2a7dd7fb0022cca04cc6a644ca0b

SHA256
c45cdca485c9e99ab819897c8cf3c790525abd9fca9f373492e99a41f5e787d3

SHA512
dce4f19e5556d0905997cdf1d7bab96d57aea09ce157416a9e44d58b86761af78321336d2385b1c90ed2960be193fd3498955bb739d29f7ec805f3c4a0cc0ad7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b20d0b88d74c84d824a3e8a358020672

SHA1
930d2a03ccde4cce9c977a3cd2e3a073a2b00040

SHA256
26c553a91f879cd2dcea6a84c14922f2b149b07a735c874660db093ed20c6eca

SHA512
3a8384ee47a05a22282301370669f4a9b453db5b08005cf688b2aea272c281d67943c434b08e8a66e60cc52f8bf2f1118c6c8b53662858a8d8bbfa645f33954d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
070b03db455a0c5695aab36c17e4911a

SHA1
e999748a64d62138cc730852e42ebe35ed05e459

SHA256
43b5d2f9c26ad46c08507f91920471ec01d7b3e07da73815e87e2cf59da99082

SHA512
19f70123333a58b0508f1dc4d26f55817163b67f686b5e3d24391d607890cb3c9363f52a290fb6acef529cb3e650e97a3bc33565137caf6ad5564c339ec98908

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
ade3af636415c0c0ffc5acd634a8de8b

SHA1
e4df89c5729a88902d64feb4edc5f61819dc1ea2

SHA256
a8583da398efbb0399715184448e2326f56b81b57a89c2e836c5fa7ec2edb15c

SHA512
ea13f3edcf4aee3d5eaf78e25eb24e69b6b9dc641baa51b17eb08e7ba93c9beb82038b14787251f72913af403ab7d46d38af3ebd1a6085013602894735a92a4c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D6V88JEY\ga[1].js

Filesize
45KB

MD5
e9372f0ebbcf71f851e3d321ef2a8e5a

SHA1
2c7d19d1af7d97085c977d1b69dcb8b84483d87c

SHA256
1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f

SHA512
c3a1c74ac968fc2fa366d9c25442162773db9af1289adfb165fc71e7750a7e62bd22f424f241730f3c2427afff8a540c214b3b97219a360a231d4875e6ddee6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\M4TQDAHL\f[1].txt

Filesize
44KB

MD5
1a9515c42300ca514386a579caa95f8e

SHA1
e16a305cf433aaa2a97cdbb9a30d62a87728c9a2

SHA256
29898f6d1fd46d94e5ad2bb5e2c25668f67689737b39730173fdde969a7a30e8

SHA512
dce732180d9bd2877c7a82961bb4e8315a0dd722f8934be830c77dff7b7359949f7b3e3c21f47218deab5ee21c6444a2e000532309a3ebee126854f551690bb2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab89A9.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar89CE.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit