socgholish | 0ea825c0acb3a19a5b452d63afb4820af2323a08d43031e6759524b879c1b3f5

Analysis

max time kernel
118s
max time network
148s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
23-01-2025 03:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_13343d50088651ef31cbf22ac1de7513.html
Size

121KB
MD5

13343d50088651ef31cbf22ac1de7513
SHA1

061b54d31e1b1cf0bd80e18d752892748fe56736
SHA256

0ea825c0acb3a19a5b452d63afb4820af2323a08d43031e6759524b879c1b3f5
SHA512

08410bb90118776f557f0680659f3470b7ddcd72207079e2623d3cf1fb45af83243e1ef9266b7d663e6c3b55e63782914bdf7e03d11db8f8943c55bdc8534111
SSDEEP

768:/BOJEXyCeEZWCv6kdAqufZnVVZfC6muQPaEDLfDfF7ws9+w+iy4:/kJECCeEZWCpqnVVZfC6M9f5w9w+ih

Score

10^/10

socgholish discovery downloader

Malware Config

Signatures

SocGholish
SocGholish is a JavaScript payload that downloads other malware.
downloader socgholish
Socgholish family
socgholish

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7BB031A1-D937-11EF-81C1-5EE01BAFE073} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "443763674"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1908	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1908	iexplore.exe
1908	iexplore.exe
2536	IEXPLORE.EXE
2536	IEXPLORE.EXE
2536	IEXPLORE.EXE
2536	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1908 wrote to memory of 2536	1908	iexplore.exe	30
PID 1908 wrote to memory of 2536	1908	iexplore.exe	30
PID 1908 wrote to memory of 2536	1908	iexplore.exe	30
PID 1908 wrote to memory of 2536	1908	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_13343d50088651ef31cbf22ac1de7513.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1908
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1908 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
9e71804c477c5c5c793bc7439ef89650

SHA1
1eefdb29f820070b76e9639338f9931b4cd05926

SHA256
457636f5ea466f1cb4d6f2bc60d2c704fa0497db64c9f137448bff52d409a971

SHA512
380361fc72358d32667d2d733e1aee40625cc22349e30240d4f71af9dc5b35f604b263b67badfe294d01b2490d5e78620e0342ab8dea88706276cf574f2941dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d3683047a9c4c5eaa5c734483c44edbd

SHA1
aebbb376f66a1719cac4f83a5a75f772ebb936a1

SHA256
dcff61f2f55979f1a694b7567c4c6c356dc16b4f2abb39985474e8aa0f3d3941

SHA512
82f7c21627c1b69fd8ea69539adb5b7a066af4fa5bea68f2b67cc9f2977a7c3bf9e402e93902c79e2d3fca8131228bab579ad668ba3952b4b77b6efcc46bbb7b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b2fcf57d0b17220d4efa8c9b3e9f1b9d

SHA1
0b29093b59698a10d8644da3ed8f1ac5fddadeef

SHA256
783caa3164ffea6f87a7d6422d213ff69897b743e6161659c897ba3ed7b5de71

SHA512
1fc6163a363876b8712fd30540e40a8a59eb6a60c86afc9e667e5eb3b16661e2f0a17bd3ce978ea13d9cdc710ae9be4dba0bed21fe6a88f1888c35be69ce0b2a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
60597baf96f832ef38ea18169e879923

SHA1
0b2ba09be658d734d506da7999f9aadcda237f36

SHA256
5c15c2f91c61459b302e9db236e4e6630bcb03a8fd25cbc86f4c273655ca1dca

SHA512
02916a98c274e3c5c64dad00c1c044da8cfdbb084130a878a7d5b71457f038425204b33bfece65220056cd5c7b975db2a634700d9691d0dc3fe272c8e59403dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
686ae8942e2df61e729a200025f4f950

SHA1
ea3de454024281a177bc0951617485425c7b16c3

SHA256
4d4e47479a09d0479ab7ed7b126e305d819eda0097ee278eb508fe4359245935

SHA512
b0604a054e67f25e8d80229f7364070f6ab4326dedb261f6987eb4fecc0f5eda5b1467ec1c13356819041f687c220f32f583f83d106dceeedfc19c1885189512

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a7662bda0865406baced36f8b716dbba

SHA1
26e82b844daeb310b9d2c316b81a0da631be1cbd

SHA256
76636c4a1a9212f90b52a113d61939efe66f09afb73ed5bf6439bedbe1070440

SHA512
4719fb5004dbff78285850ba13ffb39463a243ecbdf83f5e7e3cd3103a18601c2575e7490085726a17fe925737de52e4343c0746d3f59486a20c003b01d8f569

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1cb0f0abd31e4a6fd5c09b320282b47f

SHA1
031d412b35f23826da55e1596d0dcdc36267577a

SHA256
422c1677e7118b99a3d29737682812c65f347c7c4a6d2dca400d79da69275f54

SHA512
5308f03ad3bd8abbb5f7fe393ad312b34b9a50ea1e36cef1cc32570f80507b70f4cbbab1a237ea9081e9e470aa84701310ec1e67e09eb6fbadeda79bff67e7c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
5b1e3d28e93b8f24fc960d9c54f65421

SHA1
4f44dbad75c00fa3b641d9c6183801c7b332bd26

SHA256
bf4b9af6492ccb1c32059adbd77181937e8bc51f798c807d6966d72248ca5098

SHA512
4a9819f338299abd715afa7aa93f324c63d89bb06dd87f8102b53d57a2b87681ca92fb43f58bfdcdce92d4dbc00e0d9a9434c9e30afb896e6dd4dcccfba1c610

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\AS91FDNI\f[1].txt

Filesize
44KB

MD5
3ca556a4f7f977a3b0e3865dc3923383

SHA1
9547c5928594eb342df5b0b3b7a4724129ce85d3

SHA256
57ce2089b0ba54615624333e96a9a6258ce982c47110f713349153d9fa27ccb7

SHA512
89ece743ad69465a68d77341e3d899c1dde02679eedd6368f17f20e9c5a2ecf169eb71feda004f1d1d108cc82b0688f6a270e5d3f65e72449ad9f8592a65dc3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB6C1.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB762.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit