socgholish | 9e2e2079847e47a315ae818af87fd3ec2f7f5af6b00ae23f897ec99e71f2cd93

Analysis

max time kernel
149s
max time network
146s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19-01-2025 17:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_ce41deec7bc34210bfca75e10ac00fe0.html
Size

73KB
MD5

ce41deec7bc34210bfca75e10ac00fe0
SHA1

2dfbacb7a56aba35f89daf736ad547a405582b9d
SHA256

9e2e2079847e47a315ae818af87fd3ec2f7f5af6b00ae23f897ec99e71f2cd93
SHA512

0834fa5a3b2797db2b49855dcad44433346a73ed76520b8e516a3e38244e71579ff7f25c7b08893867385ecfa00885a0a832e2e1874209084c16d8cda550a72c
SSDEEP

1536:nB7tbmyo1AaVdyMj6y+UQaKMKpnuodThpECVq3FDq/lhGlH2yec:nBZWKaVcby+U1IuodThmCQVDqdhGlH2q

Score

10^/10

socgholish discovery downloader

Malware Config

Signatures

SocGholish
SocGholish is a JavaScript payload that downloads other malware.
downloader socgholish
Socgholish family
socgholish

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "443469467"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8A293511-D68A-11EF-A5D8-F2DF7204BD4F} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1560	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1560	iexplore.exe
1560	iexplore.exe
2680	IEXPLORE.EXE
2680	IEXPLORE.EXE
2680	IEXPLORE.EXE
2680	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1560 wrote to memory of 2680	1560	iexplore.exe	29
PID 1560 wrote to memory of 2680	1560	iexplore.exe	29
PID 1560 wrote to memory of 2680	1560	iexplore.exe	29
PID 1560 wrote to memory of 2680	1560	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ce41deec7bc34210bfca75e10ac00fe0.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1560
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1560 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
7895de75173a4829c786182ce75ec39b

SHA1
7c6edea5c96b2fa833ec40aac4acfd8dbefe4361

SHA256
0b779a93afa95445c013839df0989cc5b3862d4f56f82b27ad7ce4e3a73484e9

SHA512
7b2bffcb968c5df8e221959f58fb6381a55d55977ea2b37c6e5f9719f7c9ce17c407bd6ced714755f307af7b6a2593a97fa3a86cf2189ded41a43f009c1157b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b7d06a27a1f77ad9ead29aff29c85047

SHA1
9cfa2171cd3d9df7e14163443bd8d6d4f3be907c

SHA256
8244441fe59898693d2494914aac9af003acc1a1ce28adfa1f1d4983de11f191

SHA512
e7bd1689b65d9f4de54ebff659454ad5b639bd031197a2c8e783553cd297a0b52f56b47fb4f4f5a1c762aeadde6aa0e93e198dcfea05703d41d644a319ff2055

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0f5dfe8e9f97766f0d72b8865a38fef3

SHA1
db1c8f2d4329fe92e9b3bac12476e35573d2090c

SHA256
587167656963099149fbcab4618be006ab703156e38cde13e8d68cd9a8e801c0

SHA512
6fd59a55232775da37c8be7c5c908543ea50e4bcbb16567d7cd77b74e4fe35d5bde7aab0aded211a4e02e477d5aeb0ef8bd980cd4a8a6751d39def348abb6b6f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9740b5842705fc7eaa53ba6edd10214d

SHA1
a4c8917efaa413a0bb78e510a66b98af49cf9da5

SHA256
87510356cd27d15d3b0a41cd36f84f3bdbefbc3b46b2268cedf6c73ed68fb9a5

SHA512
bd2b80711daa6e4bf3544e5b7e1e54af9aa8b74685f7444705e8e5d51c96366af5bd8deabbaeae736129fff42d33fe64815ce08c109685ea3ce9d2e454de6413

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
69a7655171157f75af06e4c736283ac9

SHA1
0ab002575fa78bc221d6fdc94c2575c519fcbe50

SHA256
886214c75b12dc24016d7353892f606cdbe90bb5e520782d50d892bdf0b13355

SHA512
712565af71bc970269461ee7833ed1fbce05e9d25a4d891dbd5c3d1bdf2294456b031271f86c70dad6cc1a826e41ad4b15d080f98878a4236ef95e52a9af4d5e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f87c750d2b6119ee48c7cf935712b0d6

SHA1
b75ba4b0958741c9b2cbf968a52ef49fb8863713

SHA256
e0f9df82e54878bd1e085a50f4ca3f495fc4bc9cc7aef94b9084174f3cf37829

SHA512
f2008082d4f51583d4bb0b102114f346ef42a7fac41aabc9f68a50b6edf6366c38a64192eba78c31667c752ca6e458ca37d11e514b09b4f29fedf5fb7da14372

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b6fde14949664594a9857bfff7438a09

SHA1
45d7e9a0287a76516fad7cafaad64518509a9465

SHA256
d3432bec12500fdc9193e2fdab93a650380a4afc29ef30e0f5305a8cf6a58a8b

SHA512
3e194b890ecc7406fd600afff376280b8c711e266d7e1175ede715e0d5a86deae406ed78f2db688fcb57b3c01b64b69420ac67fd1f3a89d1db7328fd3bfb1199

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c05a0b8db7bc262af58819f8c6345c85

SHA1
b6120f4bf94ee1d7a3cf36bd05df9b6d915aa592

SHA256
cf3368f11e911d27090cbb981eb913913d3e7ef5578d0bf9eada4246d3a5c735

SHA512
7a976e56364b414f8765edbd0255c5d2429c3a2936c1b645b37cf3b9432424fdabdeeefb11d4aa2af0ec6476bc43eb6be94a01a55011746c20567ac04224f51c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
28f5fbf05ce91fb070133b73cd6cf37a

SHA1
1f889bbf27d967180034a18c8d7a8096cfe3c344

SHA256
8bd6a6ef99dcb831820806ff1c1fdaa62d7c79fee80f92069289ae0284627411

SHA512
288fd4f0b3e2f8a01aca7f847cffe8b13895717ec524a99f2d9e33e3a12e3d50b035ee6a884d256f664388f7c5288f1eb2f34a23163e6d67c0c86d07ec1e4d29

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d28d33864d6d9873ae1036f6321aa3d6

SHA1
876843d990ef9897e8b5672442b360f215ef3f6c

SHA256
7a83da79fc82e4d2a20cb06564f176c4b2421b93c838c308a20f399ed9e5d86c

SHA512
cc495e8c2a7693aaa58e9e66c11a6cd90b154afd8f42ee237a41f251eba747e25cab8dddcbb014b1d8b38f10838a5b1305d46d4d2eef8fd0126a5d009393ae0a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ae1de6cf05db37228f55c6c3874e14b9

SHA1
19b1e513fa7dbcbdf8f913426044af7bb8a7d54d

SHA256
d9390e31b18051908965be4d343a7a963e02087afec94fc567ce6037398fc229

SHA512
3e23f57830c892db9608083e4f791598072972b13b0ed9d303e13e51fa69ea0a4bd8d62f89e901d6fcc33f37ad4c94463ea8ceea63ac3aab59c427ffbff1c56b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
151b191d7e6aa3615137ab6d38d72c28

SHA1
210539a4d8017bb7d4279dfd1fd436eb09d94e4a

SHA256
b222d46c1df195b0cee16987c4262f0cbbb8655a007037a170605737d626eb0e

SHA512
2b63db23e28e15da9aef027c1a4f2df840e2cae3d4716a00131ae68c29ed4abcc6b8629d427b8dcc7d5d84fe6ee52d49f01ac6ef1c6c8b424e990a221acc3a36

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
dd5bf793f3069efbf00592f44cc6811a

SHA1
50d4dc716f29ba83a7915708811bafc30a5bd78c

SHA256
81e427ee8a2a61aa5f1203cd0db8e3091b60f548cf2996d4baacf4338a95bd75

SHA512
2fe2f3016ce70234bb8bf115104a92902cf20927966f631067d69da3bc67fdf6483a88015cfcd70019e3beeb5bf726c2fdf8b848329c89bc8ba8ba625d73ae5d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\QS2MOPHD\f[1].txt

Filesize
44KB

MD5
1a9515c42300ca514386a579caa95f8e

SHA1
e16a305cf433aaa2a97cdbb9a30d62a87728c9a2

SHA256
29898f6d1fd46d94e5ad2bb5e2c25668f67689737b39730173fdde969a7a30e8

SHA512
dce732180d9bd2877c7a82961bb4e8315a0dd722f8934be830c77dff7b7359949f7b3e3c21f47218deab5ee21c6444a2e000532309a3ebee126854f551690bb2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab225.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar237.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit