socgholish | 0b87554e79b70dd0af43288d2685dcc7c9bff5988e668ff2043ed3e9612f1c38

Analysis

max time kernel
120s
max time network
145s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
27-01-2025 18:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_42611258b894866b240fabf268e6d5d0.html
Size

80KB
MD5

42611258b894866b240fabf268e6d5d0
SHA1

117e717bc4017091e247883e6b976c9f0bf1ddae
SHA256

0b87554e79b70dd0af43288d2685dcc7c9bff5988e668ff2043ed3e9612f1c38
SHA512

e04c052644f33bfc875345df827108cae13b9ad01acfed3b498c1b00be5e5986faea03cd77cd2cb0c968b4296e733205571b33a19cab1cd473de5fa5e30d5a8e
SSDEEP

768:lwP3Pkpo6xh3t/OyC0f13bI0Id8wvXBvB+1rp/j4IUm0/Mq8xLIE2ItDcoF:S3Pkpo8tRBJwZsF/j4cLIE2IyoF

Score

10^/10

socgholish discovery downloader

Malware Config

Signatures

SocGholish
SocGholish is a JavaScript payload that downloads other malware.
downloader socgholish
Socgholish family
socgholish

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "444163784"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1FE4A751-DCDB-11EF-93CA-E62D5E492327} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2280	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2280	iexplore.exe
2280	iexplore.exe
2128	IEXPLORE.EXE
2128	IEXPLORE.EXE
2128	IEXPLORE.EXE
2128	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2280 wrote to memory of 2128	2280	iexplore.exe	28
PID 2280 wrote to memory of 2128	2280	iexplore.exe	28
PID 2280 wrote to memory of 2128	2280	iexplore.exe	28
PID 2280 wrote to memory of 2128	2280	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_42611258b894866b240fabf268e6d5d0.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2280
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2280 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2128

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
0730e546f7c6339eba03ab6620da48d9

SHA1
d3e824e8dad95f8df84dbcb7e7ad2879c3f831d8

SHA256
216f042d993d8a3b870082a156f83fa898e80b89b36f38092898996a046fd618

SHA512
a1a46aa2157e178ab6beced99263728780bfad5854d119a7c44d6fe30b830b38df469c31dbe20796954755bb8e40f35e6ae9ec9d4e64413e82e99e9444937b66

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f28fa9029b964c35a8eef410d56ed356

SHA1
4cdc72913647327e0df660fb5f7a4d293c149eb1

SHA256
efeb0a24ae4cab541ee7cb8f0db2a081c47bd2723374fc6c590bfeeaa2de539b

SHA512
598a04ef074d581a28a6f109cce2ef3f04008f434f30e671a1d93d1298d9c7290eda4270d0dadeaca0bf71164980107a0dafbb7b0ff299358f84bb57e189f13a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cbe284d35f7a4736bc76a93650d86ab0

SHA1
c7197887374a6095c3bb1697c2dc01d86ad0dfb0

SHA256
bd4bf2fc0f9a38b31807bf4d0d07b597f33a24c4f2d96125c15d67930382aa03

SHA512
ec99a4fa0f477032ce864259ae5f4fb25353b93dd34474144516b2f0f20edf5e356448d02a1fd6578061d19cc6cc00bd9208db8f903fb6c96c52ad68a6705aaa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
09bf33ab845dabc28f6d509aafc77328

SHA1
fdd804ea2b0297f997a03c065059d3ddcefca268

SHA256
887adc992565ac159074ef9cfa799938a9d0acb39aa2c8c8a18195e2ebad70a2

SHA512
7ae221e56f0cdc761886c0a89d6eba2c17b24cf089110e8babad3c1636e22288d0aeebdbfe20eb70e8cf845caaf9c4365fb037a6b0450f9c632438752b202157

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c0b49c1daa38dc5d9e98620ebedb0e17

SHA1
da75d36385c3ac1c476b126ba0842d3e39e61ef8

SHA256
816775a724a994b3d5b85a9a18208e615d3167e8b742f82e5441d0290fd4cf22

SHA512
20e874b7cfdf08810708059c5890366de07320f2e7a83fa672f33bd1d4d94c2a9bb2d4d6e3571a5468019c295eeaa928b6cf564b5912bcd8d205a58406435893

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
542f37e108e4a47d91e375a0cdad1153

SHA1
da4303e0969003b2434596fb9e3fe6db137dd547

SHA256
e2404de50bb47eb81f4713126055d50ab6e9662434f2ac115f9f33e28ccf6f18

SHA512
e9b5f9eafc8940c027d85e3e44af293a630fd18d929ccea17e1ac84aecfd940ef3baf12359f2f0a7755c3c1194e58670cbe4360d6c969bc1a44da70abdc21e69

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
84e1ce1f2b46ff99d8cb0d9bb05ffe27

SHA1
42856d8655096e1c279f868e5fba06687b2e6258

SHA256
59d4e6c09fff2ff6798bedfadb529b8a5c4c1f502231d0cc8c034c4f0e28c8c6

SHA512
fdcb2df5dad5d9800aab52a2515e5dca5411d3cad19a59114c36777f42675e060b640c8864ac0026e8b5dbb1508047d1524e2ada7d28395528f0fe5af76b6a8a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2132ed1c196da031304765b97969bc33

SHA1
1062968e847eb441193ce7fee81c7760aa76495c

SHA256
d21ed69bce30a9c023ed4193ecdd73e711638f29a2c700de1a6a58e5e87f7da1

SHA512
cac0c352813b1bf6009c83193d9843f3d497cfeebd631d8a19b633617fdf5c754e3daea81ed198c5070e05d11b07104418a9f79a6da14fa90fce1a9528f834ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
600f41b1efe9dfd359676cce32290e15

SHA1
db2365006ec63863860db28263b2b7df4b54ebca

SHA256
0e3748148f3d0f6d7effbee74f1b3f46f08357daf0485cbdb1805ffd4f3b03db

SHA512
36c33bc11202e5cd7a67b8f16d88a49e79927356b464ced8090b02cb4cd190e778b11ebb08f170c48d78f84b3e8b6dc57a9d1a4ddec1197f9e5fb862138b50ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
adb84d19e269f1e712f929898d999b7c

SHA1
71ae13b333e6a4c794a68496f36910844966f06c

SHA256
8264d4f3a771484304178e7c388f20dc023678aa1c63d1363e403bc598a5dd51

SHA512
f0f66b5cb16f2fbde19766f7837c7b5be85231ca8c473e9970096a5e705c24fec6959151286397380d2b979623c0ffbbdc6591a4ed232bae9c54eb85fd0a4782

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
13e39c57a80f26f5a18359fa3fe43a5e

SHA1
e65a9f017930742dc26b52095372fb7dd3f29993

SHA256
da23ba624cd0ca15a67d93cc525157e145c372e69c562be03a4041267b816756

SHA512
85bf56262852ca04adaf4d61eba7a53ce2bd0c58b511e2c295a0aa4bf80245421b32c8d792b82971dfd511e74a0ab574cb3b54bca514ec3938be0c9173abc374

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
427052a3771bb557f7da3e86a0ebeb32

SHA1
62c154c60095a33e048e58f252dbc1ca5d8a2fc0

SHA256
7fe8bb15933da74cc354929a5985f97639b0c501e3a856fb7e82c1541b205928

SHA512
3cbc83cf7d11c1ed5fb4707f89d3ea3ce90ba09be4b66e1396fd3c7d89946bd797f203df800af3d1a4cabe4f24513a194cde522ddf8f3fb7107c60ddb44070f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cc8123bc5c493d5e3679791a7560401f

SHA1
780a569da79fdd31a146cbd72daff52ab4756cc3

SHA256
03934b32556699e888e598a91c4fcb6de36642d6ef9406be63bde4689c982c2f

SHA512
312d9048a91ff39339ea51b67b236fc2c77a6afd55418efb97c63d27c73998c2c524789ae6c39b1581fddcec214cc3011542b6ce5661b5f5dc1670c27177f3eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
7b2eacb714a7bfcfc31ec494ded974f8

SHA1
5f21335e02b1092c8201757f0a7dd4782f49e3a0

SHA256
bbd605c6539df7d5a524d761ba831ddb0e4082288b7460f40bfea8d955c76871

SHA512
2de8c8f03e8872fe87d9ec3c8603c00f62699b3bbf6acd12f64ec968ccc4afe8ae4e9eb4d50c97d22f0176bd5f9750092a62f478fd5ba8005339e46032332462

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DJB1KT77\f[1].txt

Filesize
44KB

MD5
3ca556a4f7f977a3b0e3865dc3923383

SHA1
9547c5928594eb342df5b0b3b7a4724129ce85d3

SHA256
57ce2089b0ba54615624333e96a9a6258ce982c47110f713349153d9fa27ccb7

SHA512
89ece743ad69465a68d77341e3d899c1dde02679eedd6368f17f20e9c5a2ecf169eb71feda004f1d1d108cc82b0688f6a270e5d3f65e72449ad9f8592a65dc3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F91VN88R\ga[1].js

Filesize
45KB

MD5
e9372f0ebbcf71f851e3d321ef2a8e5a

SHA1
2c7d19d1af7d97085c977d1b69dcb8b84483d87c

SHA256
1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f

SHA512
c3a1c74ac968fc2fa366d9c25442162773db9af1289adfb165fc71e7750a7e62bd22f424f241730f3c2427afff8a540c214b3b97219a360a231d4875e6ddee6f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5EB5.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5EC8.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit