socgholish | 9c893e48f1d03297ebdc94175d7b87a943977ecc7fe421b7c4920a78078c03f4

Analysis

max time kernel
141s
max time network
148s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
19-01-2025 14:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_cacd42845b54ab45b6daf29965859828.html
Size

77KB
MD5

cacd42845b54ab45b6daf29965859828
SHA1

474b20aa2fb3ec074fdd0329facbd2b7a5dd177d
SHA256

9c893e48f1d03297ebdc94175d7b87a943977ecc7fe421b7c4920a78078c03f4
SHA512

ed6ecc6290dc809a097fe97f55955389849decd862f64d0cf12ab911fd7dc60d04cfef32ecd7c9065d1346be2922d6e8d1db756557b13f593f9f45255995f4dd
SSDEEP

1536:7B73bmMoTj64+nQaKMKppuodVhfEGnq3FDGllhGlHSxk8:7BnaC4+n1I4odVhsGqVDGrhGlHSxk8

Score

10^/10

socgholish discovery downloader

Malware Config

Signatures

SocGholish
SocGholish is a JavaScript payload that downloads other malware.
downloader socgholish
Socgholish family
socgholish

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{22B56E41-D675-11EF-A567-DA9ECB958399} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "443460274"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1080	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1080	iexplore.exe
1080	iexplore.exe
2800	IEXPLORE.EXE
2800	IEXPLORE.EXE
2800	IEXPLORE.EXE
2800	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1080 wrote to memory of 2800	1080	iexplore.exe	30
PID 1080 wrote to memory of 2800	1080	iexplore.exe	30
PID 1080 wrote to memory of 2800	1080	iexplore.exe	30
PID 1080 wrote to memory of 2800	1080	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_cacd42845b54ab45b6daf29965859828.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1080
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1080 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199

Filesize
170B

MD5
7a0f63c82cc29462e83c12246c36cf42

SHA1
99e23baf64c81fa0689b60761e7140c5e7e01218

SHA256
31e16bb0e0878f657c4df0e86940973e544440357157fdda934262af937c86af

SHA512
30e9173e85adb66f4a390df253ab5f1754d9cb10ee55333c6f378c59b61d43106a932e3d03abdd18cc565501ebf97f7966cf59521fddeb243abe5175ccc91684

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
b906d4d2f3660d71b108cf18f8b845f0

SHA1
fa683a5f177f6f7c58942990cf7c6efb53edd7ab

SHA256
f8b5a22faac502b3d9f9a442ff14cc34b8565d3341ea91e6a91bc72825a462ca

SHA512
b1e8f992f30a7fa240a8757959efec792c3b7330d7fb8e8e7cfd3bd25b5ccef1202bc19cb45f3d4dd7fc651ae0ccc53f703618000fc8fea244f1e6b5b2fc2a9a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
59d732057aae6c384144363569f02bab

SHA1
3865d5e7f81b15a8ee077dee2ddc07574bdcaae7

SHA256
a8f5fa9e329f31cd52db461841384ceaf94bea5b19f007e9dd0a2a4769fd93a0

SHA512
ae121bf219cbb2290268c8b07913173e5aafd76e9af96a1f1b5db916598f5cdbc234a4a9030ededf35a3efcba0a69720fe3dbe20a1020adce6e38d440b91b39a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1e45fb64a4aa9de80b8559a98fe9894b

SHA1
5cc7993150b7e4466f12a7e443d6ff5fc4620bc0

SHA256
6e51dbe5aa1745af51a8b80dcce7345671fa11e2d57dcd528d86a15e57283694

SHA512
0bade209e8414a8ce7de88dac33af3f8b2575761ff9175c24803a0e23179b8204dbd051682c922d119fb4d9dcb1647291d4353e2a5e87c6b7cb4c367897c5e6e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cbe18e1b75d6ee99b94ca364a467a7dc

SHA1
0caad66190986e3b8f4c59443b432ce289ae7b38

SHA256
3677ea44f4c1d32b479d6cc90578176a6cbecc0c3af36171d2609a0b3d4d0d78

SHA512
aa42a1cba851d751db9096f7f6713544c0790430a9c074d1f986dc98163bc110fec0ba2c1d43b962e68263428e1bb417963dc5e233bccafbf7a3ef249ac4ac9c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
17bfb28b1d97af7f259881781f1f9f54

SHA1
666014be880e3011c0af9f07fd2fc2a6355ce106

SHA256
b815f31d650b454217a20a5c6d7ebef4a0cee7340102703c4f151aee779db600

SHA512
4344a40b173311b362b386f4658357a4335db974e0a9855051fb4c8660009f33ff72579f1794d811f541b553a7716ddd1662b24d80cf9f3185096edc0bff3dd9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cd59b20b5ecbad8453ee77310ef93276

SHA1
cae7ca456f14c95db3c7a431db0e2e34b2f462ae

SHA256
f00b366f5a143e6f3ad893b812fc7ab15b5931360496800d974200617d1adba9

SHA512
40699ccc3e6b1f8e5b3e4bda5b3cbf3ee77343c758657463ab0b86e03dc9946e378598f3223a79b9318de3e7ad5d65aba6036fd2ab6aeca5ec9c59d048e20315

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c212018711ed6475571388270f20e7fd

SHA1
f8b09b9576a3ccdd01388861e54201f4881f85b3

SHA256
e697e842aa61abf8b4e14967ad761baaf4f000819038951533285e6cabcae616

SHA512
b9193765fd4ecf529d8c0eab6a3d9934f1a8518f0deb04d700cf953853c6fc3c825f8f84fd254d56ea2ac897e85c13572a1621b87b7a0d8d5ee67a96b3bbf73f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a6eb9e8a327b987b9a36b085a4bb2955

SHA1
ef33caaa18c4b47b06ff35e53b027bf50e2892bd

SHA256
c4628393ebb1daf1dbdd1813a2a5ea661361b0b8aec873aaf1cd6ed676407033

SHA512
ceb980fcd50c9c0dec3bdbb9326bca2907832185ccf143264a1d07a5dd1436ef718619381b056d2cd40c89741eab9a78def9de0c3be2f0f45423cbcc3bb2b703

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7601d50e26aaa42ab63f6dc666950177

SHA1
eff14dbac945ec5572a382ee367b8bda9a00e1bb

SHA256
3b83674f16d8a9f658ed1710274c87f87370c1b3c342f8e8831df41717292503

SHA512
af8f15f5f2cfc826c445b7426037f913f6f4e98a51f800d5e31fee7e0e507a95cadc34bde5a2ad0d256805ab8ef4c00eaad381c887a70d8ddb2b19a2af0dcfb4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5521089b8f5342e952e95ae231fb004b

SHA1
6a7f041b27a20678a49debb5678fbc42003f6496

SHA256
5af7d7dc496fe19f48e40497326663c983140a3d051831de17065a84c5e8edba

SHA512
775fe173cb63bb17b41ea9f1b66f64ddc10c16c079c8ae7ef6023b48f62610c593840e448198c24e8c2e249c1fde69ffa581c6fafadace43a3220a3011e2aa38

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
28c98a12d3c34ce8620911233d39a4af

SHA1
7b014e15c061f5db427dc64cb3e93df6b4fc5ab1

SHA256
1905f2014589013fb153dbfdf13c072764487febb2cead8d0a7b4bce4bbaef0b

SHA512
6cd1374ec06ef95ce37951cd404aab2c8fc5beb3da03daf39c41610d60fe103637c5542c512a6d375ec713133fe59789e3e033ef56fcce436351f241fb4ee15f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b55a48957000ce95b29ce1f041de9004

SHA1
a6b2ade623882fc54218d20cfe8323c4218a906d

SHA256
0a1714e84aac148641a6211a8aa3a8102690d79268f34bc95a0be09711c10317

SHA512
0f0a5c1978f7399d4bde2024cd2d6d22fe2a451bb7b9194f8cb1536fd31d60e2b108ec88c63eccefdd53a9d86360bdb314a937162231079569a2310b6bebcfdf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
4078172e5a05a43b369b511b50333583

SHA1
406cbcef5a8ce0516beb2a06a69be1060fd20cc3

SHA256
dda906d0ddbabd64c614e49f4057a907a994e1615f15f613a6ce4e4275eb9d00

SHA512
57e08c603977002d55389212f545bb5bd16ad2f084043ea1a01fafbc2dc3c6b2517b49239e17b36c537a904906c4a2b6238cb98d3f8495b3d14fa00a14bfb321

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HHT5LGG0\f[1].txt

Filesize
44KB

MD5
95a94523884fb19385819e02efd08ff4

SHA1
c0060ec538fa34036767ce04495e463a87c86375

SHA256
fa999dd10a098010048174d02c3cb8a7d3ea9a3371d796e7ee7f11aed4ee9119

SHA512
b3da685f80cdcb1c9585b813237854354b7402d81941b9c68d9726443d6f63736e8efdc9641ed55eafb18e7d31c63179cf55fb49cc994a366bfb18f8dfb5b4fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8632.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8645.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit